App Deployment Issues
Issue:
Unable to push a particular App from Deployer To Search Head
- Failing while using the flag -push-default-apps set to true
$SPLUNK_HOME/bin/splunk apply shcluster-bundle -target https://<target>:8089 -push-default-apps true
Error while deploying apps to first member, aborting apps deployment to all members: Error while updating app="Splunk_SA_Scientific_Python_linux_x86_64" on target="https://"<target>:8089: Non-200/201 status_code="413;" {"messages": [{"type":"ERROR","text":"Content-Length of <app length larger than 2147483648> too large (maximum is 2147483648)"}]}
Root cause:
App Bundle size is bigger than the default limit.
Note: When -push-default-apps flag is set to true, Splunk tries to push its default apps such as Splunk_SA_Scientific_Python_linux may be larger than 2GB (2147483648 byte), but the default content length setting is 2GB, and this is the reason that is fails to push cluster bundle.
Solution:
Either set -push-default-apps flag to false (or) increase the bundle size allowed & wait time of Deployer after pushing the bundle to Search Heads.
File name: /opt/splunk/etc/system/local/server.conf
[httpServer]
max_content_length = 3221225472
streamInWriteTimeout = 30