topic Re: Newly added forwarder not listing in clients (Forwarder management) in Deployment Architecture

Newly added forwarder not listing in clients (Forwarder management)

adminpulse — Fri, 21 Jul 2023 12:48:27 GMT

Hi Splunk support,

I recently added my second forwarder. Everything was perfectly done. Only one thing is, the newly added forwarder is not listing in client (forwarder management). After restarted also, it remains the same. Screen captures attached herewith. Please give the proper solution on this.

Thanks,

Ragav

Re: Newly added forwarder not listing in clients (Forwarder management)

isoutamo — Fri, 21 Jul 2023 13:12:56 GMT

have you install / set deployment client configuration (app) to your UF?

r. Ismo

Re: Newly added forwarder not listing in clients (Forwarder management)

adminpulse — Sat, 22 Jul 2023 04:21:32 GMT

Could you please tell the configuration steps

Re: Newly added forwarder not listing in clients (Forwarder management)

isoutamo — Sat, 22 Jul 2023 08:44:36 GMT

I prefer to separate app which have deploymentclient.conf and outputs.conf. Another way is just add deployment server via cli as docs instructed. 1st way give you an option to change those later with DS, 2nd option make this much harder.

Re: Newly added forwarder not listing in clients (Forwarder management)

adminpulse — Sat, 22 Jul 2023 09:13:36 GMT

The architecture i have maintaining is, one receiver (indexer or master) and 2 forwarders (slave). I didn't configure deployment server.

My concern is forwarder 2 should be listed in forwarder management page. That's it

Re: Newly added forwarder not listing in clients (Forwarder management)

isoutamo — Sat, 22 Jul 2023 10:04:42 GMT

When you are not configuring UF with DS there is no need to use Forwarder Management. Actually your UFs/DCs didn’t exist there unless you haven’t configured those as deployment clients. If you have only some UFs and/or another configuration tool you could use it to deploy UFs’ configurations.

Based on your explanation, your new forwarder shouldn’t seen there and your situation is ok.

If/when you don’t use DS, you should remove deploymentclient.conf from UFs. That way those don’t make any additional confusion later.

Re: Newly added forwarder not listing in clients (Forwarder management)

PickleRick — Sat, 22 Jul 2023 10:28:21 GMT

First and foremost, this is a community forum, not a Splunk support service.

Thank you for recognizing the difference.

Re: Newly added forwarder not listing in clients (Forwarder management)

PickleRick — Sat, 22 Jul 2023 10:33:57 GMT

1. Master/slave (that's an obsolete terminology, now it's manager/peer) is something used in context of indexer clustering. With indexer and forwarders it's just that - indexer and forwarders.

2. Forwarders only show in Forwarder Management if you register them with the Deployment Server (you have a DS functionality built in your all-in-one instance). It's independent from being the receiver of data forwarded by the forwarders.

3. Forwarders which send events to your indexers show in Monitoring Console.