Deployment Architecture

Error while deploying apps to first member: Error while fetching apps baseline on target=https://1.1.1.1:8089: Non-200/201 status_code=401; {"messages":[{"type":"ERROR","text":"Unauthorized"}]}

scc00
Contributor

I have set up the Deployer and Search Heads but I am unable to apply bundles to the search heads. I am getting the following error:

I am running the following command on the Deployer.

sudo -u user ./splunk apply shcluster-bundle -target https://1.1.1.1:8089

Getting the following error:

Error while deploying apps to first member: Error while fetching apps baseline on target=https://1.1.1.1:8089: Non-200/201 status_code=401; {"messages":[{"type":"ERROR","text":"Unauthorized"}]}

Deployer and SH have the same secrets.

Deployer server.conf shcluster entry:

[shclustering]
pass4SymmKey = something
shcluster_label = shcluster1

Search Head shcluster entry in server.conf

[shclustering]
pass4SymmKey = something
shcluster_label = shcluster1
conf_deploy_fetch_url =1.1.1.1:8089

Anyone know what's going on?

tariq_mohammad
Engager

Hi Guys,

Do anyone have solution of above problem. I am also facing same issue.

0 Karma

schplunk_meiste
Engager

same issue here ... any and all feedback would be greatly appreciated.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

has the issue been resolved?

————————————
If this helps, give a like below.
0 Karma

thambisetty
SplunkTrust
SplunkTrust

the issue is because of mismatch of pass4symmkey in deployer and search heads.

————————————
If this helps, give a like below.

kcooper
Communicator

Does anyone have an answer to this?
I received the same error.

thambisetty
SplunkTrust
SplunkTrust

I downvoted this post because this is not an answer.

————————————
If this helps, give a like below.
0 Karma

jcorcoran508
Path Finder

I had the same issue,  this is how I reserved my issue:

On  searchhead(s)   in /opt/splunk/etc/system/local/server.conf

[shclustering]
disabled = 0
mgmt_uri = https://10.0.0.202:8089
replication_factor = 2
shcluster_label = InCorpShcluster01
id = 33DA70FF-FC57-497A-B405-CA85C61EFACE
adhoc_searchhead = true
current_member_uri = https://10.0.0.135:8089

 

 

I had the DEPLOYER =  xxxxx     under the[shcluster]stanza , but read that the KEYc ould be located under the  [general] stanza - so I removed the pass4SymmKey = and restarted  splunk.

Deployer /opt/splunk/etc/system/local/server.conf

[general]serverName = searchhead2site1
pass4SymmKey = $7$v9H1PDth+5OR0zCD4fnfJOJ8JQ7/sdJd6+vc/jSDRX0v4suiha+Srg==

## bunch of other line configs

[shclustering]
shcluster_label = InCorpShcluster01

 

Deployer server ------------------------------------------

[splunk@deployer]lunk/bin/splunk apply shcluster-bundle -target https://10.0.0.202:8089 -auth admin:pssword

Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members. Please refer to the documentation for the details. Do you wish to continue? [y/n]: y
Bundle has been pushed successfully to all the cluster members.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...