topic Heavy Forwarder missing in Splunk Enterprise

Heavy Forwarder missing

MakszimM — Mon, 01 Dec 2025 11:58:48 GMT

Hello!

We have a Splunk Cloud, for which we set up two on-prem components:
-Heavy forwarder( To route all file based logs through it as an intermediate forwarder to Splunk Cloud)
-Deployment server( To configure UF's)

We have downloaded the uf credential package, and set it up as an app, which we pushed it down to the heavy forwarder, to test if _internal logs appear, which they do, but I do not see the HF listed as a client on my Forwarder management page anymore.

Here comes the tricky part( if i delete a serverclass, the _internal logs disappear, so it still communicates, and i can see the deployment server listed if i push the command from HF: splunk show deploy-poll, but see nothing on DS if i push:
splunk list deploy-clients

On the HF, deploymentclient.conf is configured correctly.

Any ideas?

Thanks!

Re: Heavy Forwarder missing

VatsalJagani — Tue, 02 Dec 2025 09:07:14 GMT

@MakszimM - Do you see other UFs connected to Forwarder Management UI??

If no UFs and HF is visible then you need to fix this: (outputs.conf selective forwarding missing issue)

Data not appearing in forwarder management UI
https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/9.4/configure-the-deployment-system/upgrade-pre-9.2-deployment-servers

If the issue is only with HF then it might be Network connectivity related.

From HF to DS on 8089 port

I hope this helps!!! Kindly upvote if it does!!

Re: Heavy Forwarder missing

MakszimM — Mon, 01 Dec 2025 13:35:24 GMT

HF can communicate with DS , no network issues.

No UF's have been configured yet.

Re: Heavy Forwarder missing

VatsalJagani — Tue, 02 Dec 2025 09:06:36 GMT

@MakszimM - Look at your outputs.conf as I mentioned in my answer. This is the issue I think you are having.