Deployment Architecture

Unable to apply search head cluster bundle, how to resolve error "Error while deploying apps to first member: Error while fetching apps baseline on target"?

sborys
Explorer

I am trying to push an app through my deployment server onto my 3 Search Heads. I unzipped the app into /opt/splunk/etc/shcluster/apps/

I input in /opt/splunk/bin: sudo ./splunk apply shcluster-bundle -target https://x.x.x.x:8089 -auth admin:password

In return I receive :

Error while deploying apps to first member: Error while fetching apps baseline on target=https://x.x.x.x:8089: Non-200/201 status_code=401; {"messages":[{"type":"WARN","text":"call not properly authenticated"}]}

There are similar posts out there, but I still have not found an answer.

Any ideas?

Sebastian

Gregster66
Engager

Had the same problem and managed to find out what was causing it. 

In my case I messed up when initializing the search heads and gave them the wrong value of the conf_deploy_fetch_url. 

if that value does not match with the url of the deployer it will not accept the bundle you are trying to push out. 

0 Karma

daymauler
Explorer

make sure you that your -target is pointing to the right server e.g. /opt/splunk/bin/splunk apply shcluster-bundle -target https://1.1..200:8089 instead of .g. /opt/splunk/bin/splunk apply shcluster-bundle -target https://1.1..200:8089

0 Karma

grezendedossant
Splunk Employee
Splunk Employee

You must set the key, specify the pass4SymmKey attribute in the [shclustering] stanza of the deployer's server.conf file.
[shclustering]
pass4SymmKey =

yahuja_splunk
Splunk Employee
Splunk Employee

try running this command to make sure cluster members are in sync before applying the bundle.

splunk resync shcluster-replicated-config

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...