App creation in Splunk Cloud to create dashboards?

[varshini_97]

Hi,

I have created a app in splunk cloud platform through Manage Apps -> Create Apps.

The App is created but while searching for events with the index shows the below error.

 Search process did not exit cleanly, exit_code=111, description="exited with error: Application does not exist: app_name".

what could be the issue?

Thanks in advance.

[Omega · Accepted solution]

I just fixed our issue.
Ours was related to a knowledge bundle that would not get pushed to the SHC machines.
The App would get the GUI, but search would not work because the knowledge bundle was not replicating.
I found the large lookup files within another App. The knowledge bundle had grown to 15GB  and 3GB was the limit. 
I could have possibly increased the limit, but instead I just deleted 12 GB worth of files from the bundle and re-pushed the app. The problem is now resolved.
I searched for the large files by navigating to /opt/splunk/etc/apps and running:
find . -size +1G -name *.csv 
then I backed up the large files to the /tmp directory.
then I deleted the lookup files from the GUI. (I deleted them from the GUI so the deletions would replicate across the cluster)

[Omega]

Does the app exist in a clustered search head environment? Or is the search head standalone? 
I ask because we are currently experiencing the same error with new apps created in our search head cluster.
However, when we deploy the app to our standalone search head, we are able to search indexes and there is no error. We have not yet solved the search head cluster side of the issue.

FYI. The app is properly deployed to the indexing layer. The .meta files look good and we have even copied an existing working app and renamed it. The existing app, when copied and renamed also throws the "Application does not exist" error.  

We suspect that the issue involves the .bundle file being distributed to all of the search heads in the cluster.

[richgalloway]

Sounds like you should submit a support request.

[richgalloway]

It takes time after creating the app on the search head for the app to be created on all other instances in the stack.  Depending on how soon after creating the app you ran the search, the indexers may not have been aware of it, yet.