topic Re: Why deployment apps inputs.conf blacklisted event codes, regex are not reflecting on Splunk agent server ? in Getting Data In

Why deployment apps inputs.conf blacklisted event codes, regex are not reflecting on Splunk agent server ?

balu1211 — Mon, 14 Nov 2022 13:55:13 GMT

gcusello — Mon, 14 Nov 2022 14:28:54 GMT

could you better describe your issue?

is the problem that a configuration file isn't deployed to clients or what else?

Ciao.

Giuseppe

balu1211 — Tue, 15 Nov 2022 13:34:39 GMT

Yes the configuration file not deployed to client.

gcusello — Tue, 15 Nov 2022 13:49:48 GMT

there are many possible issues to check:

are other apps deployed on your client?
- if yes don't see the following two questions;
is the client connected to the deployment Server?
- you can check this viewing in the client list in the DS;
is the 8089 port between client and DS open?
- you can check this on client using telent on this port;
has the user running Splunk on client able to write on the splunk folder?
- you should check the owner of app on the DS and the the folder and the user running splunk on client;
is the client in a serverclass using this app?
- you can cjeck this on DS by GUI i the client list.

Ciao.

Giuseppe