Deployment Architecture

Why can't I push SH bundles?

ddrillic
Ultra Champion

When running the following - /opt/splunk/bin/splunk apply shcluster-bundle -target https://<SH Host>.<domain>.com:8089, I get the following -

Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members.  Please refer to the documentation for the details. Do you wish to continue? [y/n]: y
Your session is invalid.  Please login.
Splunk username: admin
Password: 
Search Head Cluster Deployer: The configuration bundle contains the following default apps: SplunkForwarder, SplunkLightForwarder, framework, gettingstarted, introspection_generator_addon, launcher, learned, legacy, sample_app, search, user-prefs.

It is strongly recommended that you not use the deployer to push default apps to the search head cluster members. Read the topic "Use the deployer to distribute apps and configuration updates" in the Distributed Search manual on docs.splunk.com for details.

If you are sure you want to do this, push the configuration bundle again using the "-push-default-apps true" option.

The cluster has been upgraded recently to 7.x.

What can this be?

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

Hello @ddrillic,

answered on your other question regarding user-pref.conf first
the apps mentioned above, are native to splunk and exists in any new splunk install.
these apps can not be pushed in a bundle from deployer to search head cluster members.
with that being said, you can take you user-prefs.conf file and place it in a new app and push to members.
read more in this article:
http://docs.splunk.com/Documentation/Splunk/7.0.1/DistSearch/Migratefromstandalonesearchheads#Do_not...

in general steps, i will verify that there are no items in the local directory in the native splunk apps (the ones you mentioned). will pay specific attention to search and launcher, as users tend to save items in them.
then ill create a new app and name it "migration" or something of that sort. will place all files mentioned above in this app and push this app to the cluster members. make sure to have all configuration on the migration app and the app itself global

hope it helps

View solution in original post

adonio
Ultra Champion

Hello @ddrillic,

answered on your other question regarding user-pref.conf first
the apps mentioned above, are native to splunk and exists in any new splunk install.
these apps can not be pushed in a bundle from deployer to search head cluster members.
with that being said, you can take you user-prefs.conf file and place it in a new app and push to members.
read more in this article:
http://docs.splunk.com/Documentation/Splunk/7.0.1/DistSearch/Migratefromstandalonesearchheads#Do_not...

in general steps, i will verify that there are no items in the local directory in the native splunk apps (the ones you mentioned). will pay specific attention to search and launcher, as users tend to save items in them.
then ill create a new app and name it "migration" or something of that sort. will place all files mentioned above in this app and push this app to the cluster members. make sure to have all configuration on the migration app and the app itself global

hope it helps

ddrillic
Ultra Champion

For the record, a sub-issue at What is the proper location of user-prefs.conf?

0 Karma

ddrillic
Ultra Champion

I wonder if I can run the following -

/opt/splunk/bin/splunk apply shcluster-bundle -target https://<SH Host>.<domain>.com:8089 push-default-apps false

And the default Splunk apps shouldn't be on the deployer, right? so I wonder how they reached here...

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You're correct about those default apps shouldn't be there in the deployer (shcluster/apps dir). Were they there before your upgrade? May be check the timestamp to when they were copied.

ddrillic
Ultra Champion

What I see is that in production which is 6.x these default apps are there and the deployer doesn't complain whereas in stage after the upgrade to 7.x the deployer complain about them - somebody apparently changed the software ; -)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...