All Apps and Add-ons

How to troubleshoot error "File length is greater than 260" trying to deploy the latest Splunk App for Microsoft Exchange?

capilarity
Path Finder

I'm trying to deploy the latest Splunk App for Microsoft Exchange via the masternode to 3 indexers, but it's failing and usefully does not report what the error is:

In handler 'clustermastercontrol': The Master could not push the latest configuration bundle because it contains an invalid configuration. Fix any errors and push the bundle again. Alternatively, you can skip the validation process like this: "splunk apply cluster-bundle --skip-validation". Use this option carefully, as it can cause the master to push an invalid configuration to the peers. The following errors were encountered:

Looking thought the _internal index I've found an error that suggests the path is too long:

WARN  CMBundleMgr - File length is greater than 260, File creation may fail for D:/Splunk/var/run/splunk/cluster/remote-bundle/7e52479e51b29c16f30c46882e9c02ca-1427286758/apps/splunk_app_microsoft_exchange/django/splunk_app_microsoft_exchange/static/common/grayskull/common/controls/multirangeverticalslider/MultiRangeVerticalSliderRangeDefinitionModel.js

(the file path is 275 characters long)
followed by a "System cannot find the path specified message"

CMBundleMgr - Failed to create file D:/Splunk/var/run/splunk/cluster/remote-bundle/7e52479e51b29c16f30c46882e9c02ca-1427286758/apps/splunk_app_microsoft_exchange/django/splunk_app_microsoft_exchange/static/common/grayskull/common/controls/multirangeverticalslider/MultiRangeVerticalSliderRangeDefinitionModel.js while untarring D:/Splunk/var/run/splunk/cluster/remote-bundle/7e52479e51b29c16f30c46882e9c02ca-1427286758.bundle: The system cannot find the path specified.

This is a standard install, no changes have been made.

Has anyone else had this issue? Any work-arounds other than renaming ALL the files?
This a Windows Splunk install monitoring a windows environment.

0 Karma
1 Solution

capilarity
Path Finder

Found the answer is that you don't deploy the app to the indexers, its only needed on the search head.

View solution in original post

0 Karma

capilarity
Path Finder

Found the answer is that you don't deploy the app to the indexers, its only needed on the search head.

0 Karma

malmoore
Splunk Employee
Splunk Employee

What version of Exchange App are you using?
What version of Splunk Enterprise?

0 Karma

capilarity
Path Finder

Thanks for your response but I have found out the cause... I was trying to deploy the app to the indexers as I assumed there would be some index time extractions, but this is not the case.
The indexers only need to have the indexes.conf file - nothing else so don't need to deploy the app
We only have a single search head so installed manually without a problem - don't know what would happen if you had multiple search head though?

0 Karma

malmoore
Splunk Employee
Splunk Employee

Unfortunately a file rename is likely the only answer here. You could also try to set up a symbolic link, but it's not guaranteed that bundle replication would work under such a scheme.

I've filed a ticket regarding extreme file lengths on Windows for engineers to triage. In order to officially get resources on it, you should file a support case.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...