topic Re: Ubuntu not shown up in Forwarder Management in Getting Data In

Ubuntu not shown up in Forwarder Management

Tybe — Fri, 15 Dec 2023 16:24:39 GMT

Hello everybody 😀

I'm new here and recently I created this :

Ubuntu : splunk server
Ubuntu : splunk forwarder
Windows 10 : splunk forwarder

I followed the Splunk How-To video for ubuntu splunkfwd : https://www.youtube.com/watch?v=rs6q28xUd-o&t=191s

I can see my host in data summary but not in the Forwarder Management : how could you explain it ? I'm thinking about permission maybe so here is :

I also add a deploymentclient.conf in :

/opt/splunkforwarder/etc/system/local/ nano deploymentclient.conf [deployment-client] [target-broker:deploymentServer] targetUri = 192.ipfromserver:8089

Have a great evening

Re: Ubuntu not shown up in Forwarder Management

Tybe — Fri, 15 Dec 2023 16:31:02 GMT

As I posted this question my ubuntu forwarder appeared ! Anyone here could explain me why it seems linux forwarder took longer than windows to appeared ?

Re: Ubuntu not shown up in Forwarder Management

inventsekar — Fri, 15 Dec 2023 21:55:42 GMT

well, this requires some testing to find out whether this is really an issue.

if yes, then, my view is... the forwarder mgmt in DMC works as per its design. it may have some "frequency" of when to read and load the fwders info. at times some "small delay" is accepted.

if no, then, may we know, your splunk version details pls. could you pls suggest what delay you felt.. i will try to find more details for you.

thanks for learning splunk. have a great day!

Re: Ubuntu not shown up in Forwarder Management

Tybe — Fri, 09 Feb 2024 08:58:38 GMT

Hello @inventsekar ,

Thanks for replying !

Here is the info :

Splunk Enterprise
Version : 8.2.4

Delay : around 10min

Kind regards 🙂

Re: Ubuntu not shown up in Forwarder Management

isoutamo — Fri, 09 Feb 2024 10:04:39 GMT

Some comments even this is a old post.

DMC/MC (if you have configured forwarders there) shows all nodes which have sent any _internal log events to indexers were MC will look those periodically and create a lookup file for them. Basically this means that until those events are in _internal log you will see those in MC forwarder dashboard.

I think that DS's forwarder management use REST request from clients (DC) to keep book what DCs are active. Actually this means that until DC make a poll DS didn't know it. This same will happen always after you 1) reboot splunk and/or you reload deploy-config after changes. The "missing time" will depends on how often your clients are polling DS. Default is 1min

phoneHomeIntervalInSecs = <decimal>
* How frequently, in seconds, this deployment client should
  check for new content.
* Fractional seconds are allowed.
* Default: 60.

Depending on your environment you could/should increase this to e.g. 5min.

Another thing. You should never use system/local to store any configuration (there are some exceptions). Especially for DC configurations should be under own app. That way you can manage those via DS instead of managing those locally.

r. Ismo

topic Re: Ubuntu not shown up in Forwarder Management in Getting Data In

Ubuntu not shown up in Forwarder Management

Re: Ubuntu not shown up in Forwarder Management

Re: Ubuntu not shown up in Forwarder Management

Re: Ubuntu not shown up in Forwarder Management

Splunk EnterpriseVersion : 8.2.4

Re: Ubuntu not shown up in Forwarder Management

Splunk Enterprise
Version : 8.2.4