Splunk Cloud Platform

App creation in Splunk Cloud to create dashboards?

varshini_97
Path Finder

Hi,

I have created a app in splunk cloud platform through Manage Apps -> Create Apps.

The App is created but while searching for events with the index shows the below error.

 Search process did not exit cleanly, exit_code=111, description="exited with error: Application does not exist: app_name".

what could be the issue?

Thanks in advance.

Labels (2)
0 Karma
1 Solution

Omega
Engager

I just fixed our issue.
Ours was related to a knowledge bundle that would not get pushed to the SHC machines.
The App would get the GUI, but search would not work because the knowledge bundle was not replicating.
I found the large lookup files within another App. The knowledge bundle had grown to 15GB  and 3GB was the limit. 
I could have possibly increased the limit, but instead I just deleted 12 GB worth of files from the bundle and re-pushed the app. The problem is now resolved.
I searched for the large files by navigating to /opt/splunk/etc/apps and running:
find . -size +1G -name *.csv 
then I backed up the large files to the /tmp directory.
then I deleted the lookup files from the GUI. (I deleted them from the GUI so the deletions would replicate across the cluster)

View solution in original post

Omega
Engager

I just fixed our issue.
Ours was related to a knowledge bundle that would not get pushed to the SHC machines.
The App would get the GUI, but search would not work because the knowledge bundle was not replicating.
I found the large lookup files within another App. The knowledge bundle had grown to 15GB  and 3GB was the limit. 
I could have possibly increased the limit, but instead I just deleted 12 GB worth of files from the bundle and re-pushed the app. The problem is now resolved.
I searched for the large files by navigating to /opt/splunk/etc/apps and running:
find . -size +1G -name *.csv 
then I backed up the large files to the /tmp directory.
then I deleted the lookup files from the GUI. (I deleted them from the GUI so the deletions would replicate across the cluster)

Omega
Engager

Does the app exist in a clustered search head environment? Or is the search head standalone? 
I ask because we are currently experiencing the same error with new apps created in our search head cluster.
However, when we deploy the app to our standalone search head, we are able to search indexes and there is no error. We have not yet solved the search head cluster side of the issue.

FYI. The app is properly deployed to the indexing layer. The .meta files look good and we have even copied an existing working app and renamed it. The existing app, when copied and renamed also throws the "Application does not exist" error.  

We suspect that the issue involves the .bundle file being distributed to all of the search heads in the cluster.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sounds like you should submit a support request.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It takes time after creating the app on the search head for the app to be created on all other instances in the stack.  Depending on how soon after creating the app you ran the search, the indexers may not have been aware of it, yet.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...