Skip to main content

when i try to upgrade splunk app via search head deployer i get an error that it fails to apply bundle because cribl is busy

Error while deploying apps to first member, aborting apps deployment to all members: Error while updating app=cribl on target=https://10.150.22.183:8089: Non-200/201 status  _code=500; {"messages":[{"type":"ERROR","text":"\n In handler localapps: Error installing application: Failed to copy: /opt/splunk/var/run/splunk/bundle_tmp/eb494662a4bfa  723/cribl/bin to /opt/splunk/etc/apps/cribl/bin. 2 errors occurred. Description for first 2: [{operation:\"copying source to destination\", error:\"Text file busy\", src:\"  /opt/splunk/var/run/splunk/bundle_tmp/eb494662a4bfa723/cribl/bin/cribl\", dest:\"/opt/splunk/etc/apps/cribl/bin/cribl\"}, {operation:\"transfering contents from source to d  estination\", error:\"Text file busy\", src:\"/opt/splunk/var/run/splunk/bundle_tmp/eb494662a4bfa723/cribl/bin\", dest:\"/opt/splunk/etc/apps/cribl/bin\"}]"}]}

I dont know if thats the correct answer, i worked around it by disable on each shc member the scripted input that starts cribl after that i was able to successfully deploy the app to shc


Yes, that is the correct method. Our splunk app does start its own cribl instance inside of the installation directory.


Reply