Problem Replicating Bundle when Enabling MS Graph Security API Add-On for Splunk

[flunardi]

Hi Community team, I have an issue whenever I enable the this add-on on my Search Head with this below error,

Problem replicating config (bundle) to search peer ' X.X.X.X:8089 ', Upload bundle="E:\Splunk\var\run\SPL-SH2-1630562214.bundle" to peer name=SPL-Ind3 uri=https://X.X.X.X:8089 failed; http_status=400 http_description="Failed to untar the bundle="E:\Splunk\var\run\searchpeers\SPL-SH2-1630562214.bundle". This could be due Search Head attempting to upload the same bundle again after a timeout. Check for sendRcvTimeout message in splund.log, consider increasing it.".

Health Check: One or more apps ("TA-microsoft-graph-security-add-on-for-splunk") that had previously been imported are not exporting configurations globally to system. Configuration objects not exported to system will be unavailable in Enterprise Security.

Note: we had increased sendRcvTimeout in distsearch.conf at both SH to 900 as per our requirement need.

We are using Splunk Enterprise 8.0.5 on premise with 2 SH (1 with ES), 3 IDX, 1 Deployment/MC, 1 LM, 1 HF

Anyone ever experiencing this issue or successfully installed and use the add-on in your environment?.. Appreciate the feedback, thanks

[Mo]

Hope you found the answer in another thread. I just came across the same issue and found this solution.

Seems to be the standard .meta in most apps I use together with ES.

https://community.splunk.com/t5/Splunk-Search/Why-do-we-have-the-not-exporting-configurations-global...