Deployment Architecture

ERROR reading deployment app that isn't deployed to clients

DEAD_BEEF
Builder

My search head is the deployment server. Going through the splunkd log for ERROR and finding the following errors for multiple apps

ERROR Application - Application=<my_app> cannot be loaded, as path=/opt/splunk/etc/deployment-apps/<my_app> does not exist.
ERROR Serverclass - Failed to load app. Application=<my_app> cannot be loaded, as path=/opt/splunk/etc/deployment-apps/<my_app> does not exist.

Here are the oddities to this:

  • the <my_app> folder DOES exist in /opt/splunk/etc/deployment-apps/
  • the <my_app> is NOT deployed to any clients nor part of any server class
  • the folder is owned by splunk:splunk
  • the folder has the same permissions as the other app folders

If the folder exists, owned by the correct user with the right permissions, and is NOT deployed, what is causing these errors to generate? Is there some file that needs to be refreshed so that the deployment server stops trying to access/send this to the clients?

0 Karma
1 Solution

DEAD_BEEF
Builder

The app was listed in one of the [serverClass:...] entries despite not being deployed to any client nor listed under any server class (in the gui). I commented out and restarted services. I have not seen the error since then so I'll close this out as the solution. Check your serverclass.conf!

View solution in original post

0 Karma

DEAD_BEEF
Builder

The app was listed in one of the [serverClass:...] entries despite not being deployed to any client nor listed under any server class (in the gui). I commented out and restarted services. I have not seen the error since then so I'll close this out as the solution. Check your serverclass.conf!

0 Karma

somesoni2
Revered Legend

Try to run btool on serverclass.conf to see if any instance of serverclass.conf file is doing anything with <my_app>.

$SPLUNK_HOME/bin/splunk btool serverclass list --debug | grep my_app
0 Karma

DEAD_BEEF
Builder

<my_app> did show up in one listing. It looks like <my_app> was listed in one of the [serverClass:...] despite not being deployed to any client nor listed under any server class (in the gui). I commented <my_app> out and restarted services.

No new errors of this kind since the changes. I will monitor for a few days and mark as solved if this proves to be the solution.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...