Splunk SHC cluster bundle with ES errors: What configs can I change to increase this limit so I can use my SHC Deployer?

[andrew207]

I have an SHC and I am using an SHC Deployer to deploy apps to it. Those apps include Splunk ES which is very large. The latest 7.0.0 update for ES may be so large that it causes errors when I apply the cluster bundle.

I have tried increasing max_content_length in [httpServer] in server.conf, this did not work.

What configs can I change to increase this limit so I can use my SHC Deployer? It seems odd that I can't deploy an unmodified ES installation according to the documentation because it's beyond Splunk's limits. 

splunk apply shcluster-bundle -target xxx -auth xxx

Error while deploying apps to target=xxx with members=x: Error while updating app=Splunk_SA_Scientific_Python_Linux_x86_64 on target=xxx: Non-200/201 status_code=413; {"messages":[{"type":"ERROR","text":"Content-Length of 2147484959 too large (maximum is 2147483648)"}]},...repeated for each member

[amgibby]

We had the same problem deploying the same app (Splunk_SA_Scientific_Python_Linux_x86_64) using the deployer. Under the hood, the deployer is using HTTP to push app bundles to the Search Head Cluster. The search heads (acting as an HTTP server) are rejecting the bundle for this app because it exceeds the default setting for content length.

You need to modify server.conf on the search heads to include the following setting:

[httpServer]
max_content_length = 5000000000

This changes the default setting from 2147483648 (about 2 GB) to 5 GB.

[gjlewis]

This worked for me, thanks!

[tshah-splunk]

This is a known issue for PSC app to cause bundle size to increase exponentially and the reason to have PSC app installed on standalone instances other than the clusters. However, PSC comes bundled with ES and cannot be separated from that. I discovered one of the conf setting mentioned in the upgrade steps for ES is to change the max_upload_size parameter in web.conf and increase it's value. 

Here's the link to upgrade doc for ES to v7.0.0 in SHC environment - https://docs.splunk.com/Documentation/ES/7.0.0/Install/UpgradeEnterpriseSecuritySHC.

An upvote is appreciated if this helps you resolve the issue.

[dwraesner]

Hello tshah-splunk,

Increasing the max_upload_size in web.conf worked in my case.

Gave you a Karma point.

Thanks  😎