Upgrading splunk app fails because cribl is working

SonOfBuzi

when i try to upgrade splunk app via search head deployer i get an error that it fails to apply bundle because cribl is busy

Error while deploying apps to first member, aborting apps deployment to all members: Error while updating app=cribl on target=https://10.150.22.183:8089: Non-200/201 status                                                                             _code=500; {"messages":[{"type":"ERROR","text":"\n In handler localapps: Error installing application: Failed to copy: /opt/splunk/var/run/splunk/bundle_tmp/eb494662a4bfa                                                                             723/cribl/bin to /opt/splunk/etc/apps/cribl/bin. 2 errors occurred. Description for first 2: [{operation:\"copying source to destination\", error:\"Text file busy\", src:\"                                                                             /opt/splunk/var/run/splunk/bundle_tmp/eb494662a4bfa723/cribl/bin/cribl\", dest:\"/opt/splunk/etc/apps/cribl/bin/cribl\"}, {operation:\"transfering contents from source to d                                                                             estination\", error:\"Text file busy\", src:\"/opt/splunk/var/run/splunk/bundle_tmp/eb494662a4bfa723/cribl/bin\", dest:\"/opt/splunk/etc/apps/cribl/bin\"}]"}]}

SonOfBuzi

I dont know if thats the correct answer, i worked around it by disable on each shc member the scripted input that starts cribl after that i was able to successfully deploy the app to shc

SonOfBuzi

I dont know if thats the correct answer, i worked around it by disable on each shc member the scripted input that starts cribl after that i was able to successfully deploy the app to shc

Johan Woger

Yes, that is the correct method. Our splunk app does start its own cribl instance inside of the installation directory.