All Apps and Add-ons

Automatic linux/nix-TA installation on indexer

tfechner
Path Finder

Hi,

At startup of our indexer beeing part of a cluster there is an error stating that we have 2 *nix-TA installed. One in /etc/apps and one in etc/slave-apps.
As we are using only the clustermaster to deploy apps the first place etc/apps is wrong and not used by our setup.
I deleted this app and after a restart the app is again there.
I did not install splunk with some special command line options.

So why is Splunk installing an app in the wrong possition and where is the configuration?

Labels (1)
Tags (1)
0 Karma
1 Solution

vinod94
Contributor

Hi dyude, @tfechner ,

Can you try removing the app from cluster master and then push the bundle. Then, try deleting the app from etc/apps. Once the app is gone from etc/apps you can again install the app from cluster master.

I hope none of your indexers are connected as deployment client which has Nix app in the corresponding server class. Just mentioned it for the safe side.

View solution in original post

0 Karma

vinod94
Contributor

Hi dyude, @tfechner ,

Can you try removing the app from cluster master and then push the bundle. Then, try deleting the app from etc/apps. Once the app is gone from etc/apps you can again install the app from cluster master.

I hope none of your indexers are connected as deployment client which has Nix app in the corresponding server class. Just mentioned it for the safe side.

0 Karma

tfechner
Path Finder

mh.. it's not this way:
I never installed the app in /etc/app. I always use the cluster-master.

I remove the wrong app, restart the peer and then the app is again in /etc/apps!
No deployment-client used.

0 Karma

vinod94
Contributor
0 Karma

tfechner
Path Finder

oh - nice to see.
But it is the offical splunk audit linux-TA "TA-linux_audit".
We will search if there is any file which is created by the SHC or similar

0 Karma

vinod94
Contributor

Can you try moving the app which basically resides in cluster master to some other directory and then push the bundle(which basically will push the app without TA-nix) and see if the app is still in etc/apps on the slaves.

0 Karma

tfechner
Path Finder

ok - removed on CM this app - deployed bundle.
then updates to the recent version, and re-deploy.
works now.

0 Karma

vinod94
Contributor

Glad to know that it worked.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...