Deployment Architecture

Unable to deploy an custom app through a deployer

srikanth1216
New Member

Hello Team , i have built search head cluster and i 'm trying to deploy and app thru deployer but getting the error "Error while deploying apps to first member, aborting apps deployment to all members: Error while updating app=new_app on target=https://...:8089: Non-200/201 status_code=500; {"messages":[{"type":"ERROR","text":"\n In handler 'localapps': Error installing application: Failed to copy file from \"/opt/splunk/var/run/splunk/bundle_tmp/e7e684930fe6ff3c/new_app/sample_app\" to \"/opt/splunk/etc/apps/new_app/sample_app\"."}]}"

Here are my app details of my app, its a simple alert i saved in my app which i named new_app

root@deployer:/opt/splunk/etc/shcluster/apps# ll
total 20
drwxrwxrwt 3 splunk splunk 4096 Nov 20 04:39 ./
drwxr-xr-x 4 splunk splunk 4096 Nov 10 22:22 ../
-r--r--r-- 1 splunk splunk 121 Oct 19 02:20 README
drwxr-xr-x 2 splunk splunk 4096 Nov 20 04:27 new_app/
-rw-r--r-- 1 splunk splunk 46 Nov 14 19:25 temp
root@deployer:/opt/splunk/etc/shcluster/apps# cd new_app
root@deployer:/opt/splunk/etc/shcluster/apps/new_app# ll
total 12
drwxr-xr-x 2 splunk splunk 4096 Nov 20 04:27 ./
drwxrwxrwt 3 splunk splunk 4096 Nov 20 04:39 ../
-rwxrwxrwx 1 splunk splunk 492 Nov 20 04:27 sample_app*
root@deployer:/opt/splunk/etc/shcluster/apps/new_app# cat sample_app
[sample alert1]
action.email = 1
action.email.to = ********@gmail.com
action.email.useNSSubject = 1
alert.suppress = 0
alert.track = 0
counttype = number of events
cron_schedule = 0 6 * * 1
dispatch.earliest_time = -1w
dispatch.latest_time = now
display.general.type = statistics
display.page.search.tab = statistics
enableSched = 1
quantity = 0
relation = greater than
request.ui_dispatch_app = search
request.ui_dispatch_view = search
search = index=
| stats count by source,sourcetype

0 Karma

nickhills
Ultra Champion

you need to have your alert configured in the file named alert_actions.conf
You should locate this file in /opt/splunk/etc/shcluster/apps/new_app/default/alert_actions.conf

If my comment helps, please give it a thumbs up!
0 Karma

tprz
Explorer

you need to have typical app structure

"shcluster" directory
-myapp
--local
---whatever.conf

that's what this error was for me

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...