Upgrading splunk app fails because cribl is working

when i try to upgrade splunk app via search head deployer i get an error that it fails to apply bundle because cribl is busy

Error while deploying apps to first member, aborting apps deployment to all members: Error while updating app=cribl on target= Non-200/201 status                                                                             _code=500; {"messages":[{"type":"ERROR","text":"\n In handler 'localapps': Error installing application: Failed to copy: /opt/splunk/var/run/splunk/bundle_tmp/eb494662a4bfa                                                                             723/cribl/bin to /opt/splunk/etc/apps/cribl/bin. 2 errors occurred. Description for first 2: [{operation:\"copying source to destination\", error:\"Text file busy\", src:\"                                                                             /opt/splunk/var/run/splunk/bundle_tmp/eb494662a4bfa723/cribl/bin/cribl\", dest:\"/opt/splunk/etc/apps/cribl/bin/cribl\"}, {operation:\"transfering contents from source to d                                                                             estination\", error:\"Text file busy\", src:\"/opt/splunk/var/run/splunk/bundle_tmp/eb494662a4bfa723/cribl/bin\", dest:\"/opt/splunk/etc/apps/cribl/bin\"}]"}]}

I don’t know if that’s the correct answer, i worked around it by disable on each shc member the scripted input that starts cribl after that i was able to successfully deploy the app to shc

1 UpGoat

Yes, that is the correct method. Our splunk app does start its own cribl instance inside of the installation directory.

1 UpGoat