I'm running Splunk 7.2.1. It won't work without the system link. I tried it both ways... # ls apps deployment-apps system # rm -f system # /opt/splunk/bin/splunk btool check --dir=/tmp/staging # /opt/splunk/bin/splunk -version Splunk 7.2.1 (build be11b2c46e23) Once I create a symbolic link to /opt/splunk/etc/system, it works again. ... View more

Apparently you have to create another symbolic link for /opt/splunk/etc/system or else it won't work. So I did the following: cd /opt/splunk/etc/ mkdir deployment-apps-for-btool cd deployment-apps-for-btool ln -s /opt/splunk/etc/deployment-apps apps ln -s /opt/splunk/etc/system system /opt/splunk/bin/splunk btool check --dir=/opt/splunk/etc/deployment-apps-for-btool/ ... View more

I tried the following and did not see any results. /opt/splunk/bin/splunk btool check --dir=/opt/splunk/etc/deployment-apps Is this syntax correct? ... View more

I came across a similar issue today and was able to fix it. The issue was due to having "$HADOOP_CONF_DIR" as part of my Yarn classpath. In my indexes.conf file, my Yarn classpath was set to this: vix.yarn.application.classpath = $HADOOP_CONF_DIR,/usr/hdp/current/hadoop-client/*,/usr/hdp/current/hadoop-client/lib/*,/usr/hdp/current/hadoop-hdfs-client/*,/usr/hdp/current/hadoop-hdfs-client/lib/*,/usr/hdp/current/hadoop-yarn-client/*,/usr/hdp/current/hadoop-yarn-client/lib/*,/usr/hdp/current/hadoop-mapreduce-client/* Since $HADOOP_CONF_DIR is set to "/etc/hadoop/conf", I updated the Yarn classpath to this: vix.yarn.application.classpath = /etc/hadoop/conf/*,/usr/hdp/current/hadoop-client/*,/usr/hdp/current/hadoop-client/lib/*,/usr/hdp/current/hadoop-hdfs-client/*,/usr/hdp/current/hadoop-hdfs-client/lib/*,/usr/hdp/current/hadoop-yarn-client/*,/usr/hdp/current/hadoop-yarn-client/lib/*,/usr/hdp/current/hadoop-mapreduce-client/* I restarted the search head and ran another query. It completed with no errors. Hope this helps. ... View more

Cool thanks somesoni2! ... View more