Skip to main content
Solved

Upgrading splunk app fails because cribl is working

  • March 11, 2025
  • 2 replies
  • 14 views

when i try to upgrade splunk app via search head deployer i get an error that it fails to apply bundle because cribl is busy

Error while deploying apps to first member, aborting apps deployment to all members: Error while updating app=cribl on target=https://10.150.22.183:8089: Non-200/201 status  _code=500; {"messages":[{"type":"ERROR","text":"\n In handler localapps: Error installing application: Failed to copy: /opt/splunk/var/run/splunk/bundle_tmp/eb494662a4bfa  723/cribl/bin to /opt/splunk/etc/apps/cribl/bin. 2 errors occurred. Description for first 2: [{operation:\"copying source to destination\", error:\"Text file busy\", src:\"  /opt/splunk/var/run/splunk/bundle_tmp/eb494662a4bfa723/cribl/bin/cribl\", dest:\"/opt/splunk/etc/apps/cribl/bin/cribl\"}, {operation:\"transfering contents from source to d  estination\", error:\"Text file busy\", src:\"/opt/splunk/var/run/splunk/bundle_tmp/eb494662a4bfa723/cribl/bin\", dest:\"/opt/splunk/etc/apps/cribl/bin\"}]"}]}

Best answer by SonOfBuzi

I dont know if thats the correct answer, i worked around it by disable on each shc member the scripted input that starts cribl after that i was able to successfully deploy the app to shc

2 replies

  • Author
  • Inspiring
  • Answer
  • March 11, 2025

I dont know if thats the correct answer, i worked around it by disable on each shc member the scripted input that starts cribl after that i was able to successfully deploy the app to shc


  • Employee
  • March 11, 2025

Yes, that is the correct method. Our splunk app does start its own cribl instance inside of the installation directory.