cluster Bundle fail for App Splunk_TA_ontap

[sat94541]

Wanted to deploy app Splunk_TA_ontap from cluster master to cluster peer …

Splunk apply cluster-bundle command, failed with following error:

---

##
In handler 'clustermastercontrol': Possible typo in stanza [ta_ontap_collection_worker://alpha] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 15: capabilities = *
Possible typo in stanza [ta_ontap_collection_worker://alpha] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 16: log_level = INFO
Possible typo in stanza [ta_ontap_collection_worker://alpha] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 19: duration = 1m
Possible typo in stanza [ta_ontap_collection_worker://beta] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 22: capabilities = *
Possible typo in stanza [ta_ontap_collection_worker://beta] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 23: log_level = INFO
Possible typo in stanza [ta_ontap_collection_worker://beta] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 26: duration = 1m
Possible typo in stanza [ta_ontap_collection_worker://gamma] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 29: capabilities = *
Possible typo in stanza [ta_ontap_collection_worker://gamma] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 30: log_level = INFO
Possible typo in stanza [ta_ontap_collection_worker://gamma] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 33: duration = 1m
Possible typo in stanza [ta_ontap_collection_worker://delta] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 36: capabilities = *
Possible typo in stanza [ta_ontap_collection_worker://delta] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 37: log_level = INFO
Possible typo in stanza [ta_ontap_collection_worker://delta] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 40: duration = 1m
Possible typo in stanza [ta_ontap_collection_worker://epsilon] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 43: capabilities = *
Possible typo in stanza [ta_ontap_collection_worker://epsilon] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 44: log_level = INFO
Possible typo in stanza [ta_ontap_collection_worker://epsilon] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 47: duration = 1m
Possible typo in stanza [ta_ontap_collection_worker://zeta] in /opt/splunk/etc/master-apps/Splunk_TA_ontap/local/inputs.conf, line 50: capabilities = *

[rbal_splunk]

This has been identified as Bug .

SPL-85052:Unable to deploy Splunk_TA_ontap from cluster master to cluster peer

As a workaround customer was recommend to skip the validation to deploy cluster bundle ..Using command (./splunk apply cluster-bundle --skip-validation --answer-yes)

Issue seems to be that ‘Splunk apply cluster-bundle’ is validating the inputs.conf from TA against the Spec file of the splunk and not TA.

Note: --skip-validation i will skip both master side (btool check) and slave side index validation. This should be used only for above issue only.