Error: "There was an error processing the upload..."

[alex_huffman]

I'm using Splunk Enterprise 9.2.0.  We are able to update our app, which is run on a VM in vSphere, using a .tar.gz file from GitLab...  [our_app_name].tar.gz

So, it works just fine on that VM, but when I try to update the one we have running in a cloud environment in AWS, I get the following error after I upload a .tar.gz file:

There was an error processing the upload.Invalid app contents: archive contains more than one immediate subdirectory: and [our_app_name]

Any advice on what might be the fix for that, or how I should start troubleshooting, I would appreciate.  Thank you.

[alex_huffman]

Thanks.  OK, yeah, I just had to use the tar -C flag/option to unzip to a new directory, to make sure it unzipped *ONLY* the archive files there, and then I just zip it back up normally.  So, just create a new dir, and then use the -C flag/option on the tar command to unzip.  That's the easy fix.  Good to go.

[isoutamo]

Hi
I have always Makefile which generates deployment ready xxx.spl files from current clients all apps into one directory + combined tar file. Those are easy to transfer and use where they are needed.
r. Ismo

[deepakc]

adding to @victor_menezes  said. 

When uploading apps to Splunk cloud you must pass various checks. Splunk Appinspect has various standards. (On premise is different)

When you upload the app it will run check_package_compression checks, and in there you can't have . or __MACOSX type for when on Mac

"Splunk App does not contain any directories or files that start with a ., or directories that start with __MACOSX"

So, check your app compressed app file and remove any hidden folders or files it may even have a leading /.  

tar -tzf your_file.tar.gz

You may be able to use the git archive command (but need to ensure you remove hidden folder etc)

It’s worth looking here for latest cloud check  updates, as this criterion for cloud does change

https://dev.splunk.com/enterprise/docs/relnotes/relnotes-appinspectcli/whatsnew/ 

https://dev.splunk.com/enterprise/reference/appinspect/appinspectcheck/ 

[victor_menezes · Accepted solution]

Hey Alex,
You mean you are trying to use your tar.gz from gitlab, it can be the case git itself is appending any other folders to the root dir structure in that tar.gz? Check the content to see if that is the case (including hidden ones). It may be the case to simple remove them and try again.