We have a deployment server which pushes custom apps to Search Head, Indexers, Heavyforwarders. We have Search app which contains props and transforms for Search Time field extraction. Whenever we make changes to the conf files within and when we issue the command splunk reload deploy-server / splunk restart on the deployment monitor, the app fails to get pushed to the search head. The other servers have no issue like this. We see the following errors in splunkd.log from the search head
01-08-2013 17:05:29.427 -0500 WARN DeployedApplication - Unable to remove folder: D:\ProgramFiles\Splunk\etc\apps\ipc_etac_search_props. Splunk will continue trying to install application. There are no more files.
01-08-2013 17:05:29.427 -0500 WARN DeployedApplication - Installing app: ipc_etac_search_props to location: D:\ProgramFiles\Splunk\etc\apps\ipc_etac_search_props
01-08-2013 17:05:29.427 -0500 WARN DeployedApplication - Failed to create file D:\ProgramFiles\Splunk\etc\apps\ipc_etac_search_props\lookups\alliance_alarm_info_lookup.csv while untarring D:\ProgramFiles\Splunk\var\run\ipc_All_Search\ipc_etac_search_props-1357681952.bundle: Access is denied.
01-08-2013 17:05:29.427 -0500 WARN DeployedServerClass - There was a problem installing app: ipc_etac_search_props for server class: ipc_All_Search
01-08-2013 17:05:29.474 -0500 ERROR ConfObjectManagerDB - Cannot initialize: D:\ProgramFiles\Splunk\etc\apps\ipc_etac_search_props\metadata\local.meta: The system cannot find the path specified.
Symptom of the issue is usually the app's metadata folder is missing in the deployed app. Once the splunkd restart has occurred, metadata folder reappears, and app would be functional again. However, the next deployment cycle would break it again, and a splunkd restart would be required.
