Deployment Architecture

Issues deploying initial shcluster apps from deployer

jcspigler2010
Path Finder

I'm having an issue deploying my first bundle of shcluster apps. I have all untarred apps in /opt/splunk/etc/shcluster, permissions are correct, all SH cluster members are configured with my deployers IP.

Everytime I run the "splunk apply shcluster-bundle -target https://172.16.31.36:8089 -auth admin:password

I get the following error

"Error while deploying apps to first member: Found zero deployable apps to send; /opt/splunk/etc/shcluster is likely empty; ensure that the command is being run on the deployer. If intentionally attempting to remove all apps from the search head cluster use the "force" option. WARNING: using this option with an empty shcluster directory will delete all apps previously deployed to the search head cluster; use with extreme caution!"

I haven't been able to find ANYTHING on this error. Any help would be great

0 Karma
1 Solution

adonio
Ultra Champion

jcspigler2010
Path Finder

Jeeze....
I was under the impression from docs that it went in the root of /shcluster dir.

Thanks adonio!

0 Karma

adonio
Ultra Champion

@harsmarvania57 comment is right
place in .../etc/shcluster/apps
read here more:
http://docs.splunk.com/Documentation/Splunk/6.6.0/DistSearch/PropagateSHCconfigurationchanges#Where_...

harsmarvania57
Ultra Champion

Hi,

All untarred app should be in /opt/splunk/etc/shcluster/apps/ directory.

Thanks,
Harshil

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...