Security

Deployment Server - Changes not pushed even though there is successful phonehome connection

Poojitha
Path Finder

Hi All,

I have setup new deployment server and new heavy forwarder. There is successful phonehome connection when I check with command "./splunk list deploy-clients". The client is successfully connecting the server.

I want to push new app to this new heavy forwarder. But the app is not getting pushed from Deployment server.

I verified that  the app is under deployment_apps directory. I also checked serverclass.conf file.Both are looking good.

What is the reason that app is not getting written ? 
Do I need to first create a app in HF manually so that DS finds the app and pushes the changes ? 

Regards,
PNV

Labels (1)
0 Karma

Poojitha
Path Finder

@gcusello  Thanks for your response.

I checked the first point you mentioned. The app which I want to push has splunk user permission on it. The HF is set to run as splunk as well. So, its looking fine here.

What do you mean by "flagged the retart Splunk flag for that app." ? I didnot get this. Please can you explain more.

I am deploying custom app.

Regards,
PNV


0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Poojitha,

you can see in the Deployment server GUI that there's an option to flag that requires a splunk restart on the client when an app is updated, this is mandatory to reload the configurations on the client.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Poojitha,

at first check if the owner of the app is splunk: if it's root and you are using splunk user to run splunk serveces in the HF you could have problems.

Then check if yu flagged the retart Splunk flag for that app.

At least check again (even if you already checked) the serverclass: check if the server is inserted in the serverclass.

Last check, what kind of app are you depoying, a custom or a splanbase app?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...