Hi there I've run into an issue where I can sort of guess why I'm having issues though have no clear idea regarding how to solve it. In our distributed environment we have a "lookup app" in our dep...
See more...
Hi there I've run into an issue where I can sort of guess why I'm having issues though have no clear idea regarding how to solve it. In our distributed environment we have a "lookup app" in our deployer, TA_lookups/lookups/lookupfile.csv Recently a coworker added a few new lookup files and made additions to the file in question. This is where the problem manifests, logging onto the deployer, checking that the correct files are present in /opt/splunk/etc/shcluster/apps/TA_lookups/lookups/lookupfile.csv Everything looks great. Applying the bundle worked without any complaints/errors. All the new csv files show up in the cluster and are accesible from the GUI, however. This one file, the "lookupfile.csv" is not updated. So I can sort of guess that it may have something to do with the file being in use or something, though I am stompt as to how I should go about solving this? I've tried making some additional changes to the file, checked for any wierd linebraking or something, and nothing. I can se from the CLI that this one file has not been modified since the initial deployment, so the deployer applies the bundle, there are no complaints on either end that I can find, it just skips this one pre-existing csv file completely and as far as I can see, silently. What do I do here? Is there a way to "force" the push? Is the only way to solve this to just manually remove the app from the SH cluster an push again? All suggestions are welcome Best regards