topic Re: Heavy Forwarder not showing in Deployment Server in Getting Data In

Heavy Forwarder not showing in Deployment Server

ashish9433 — Thu, 12 Oct 2017 19:35:58 GMT

Hi Team,

I am facing a very strange issue.

I have two heavy forwarder, let say host1 and host2. I am getting data from both host1 and host2 on Indexer's but when only either of them get listed on deployment server at a time.

If I restart host1, deployment server will list host1, as soon as I go ahead and restart host2, host1 gets de-listed and host2 starts showing up. So at any point of time I am unable to get both listed together.

PS : - what has happened earlier was in inputs.conf file of host2 below was by mistake done and later it was fixed but the problem is not fixed.

inputs.conf of host2
[default]
host=host1

Since in host2, the host=host1 was configured, we realized later and fixed it but both the forwarders are not getting listed together on deployment server since then.

Any help? how to troubleshoot this issue.

Re: Heavy Forwarder not showing in Deployment Server

s2_splunk — Thu, 12 Oct 2017 19:53:53 GMT

Have you restarted your deployment server since making the change to inputs.conf on the deployment client?

Did you clone your HF installs or were they installed by running the installation scripts individually? If you cloned, take a look at $SPLUNK_HOME/etc/instance.cfg and you'll probably see that both HFs are using the same guid. Delete the file on one of them and restart the HWF, it will generate a new guid. Not 100% sure this causes the behavior you are observing, but risk-free to try.

Re: Heavy Forwarder not showing in Deployment Server

ashish9433 — Thu, 12 Oct 2017 20:10:41 GMT

Thanks a lot @ssievert, it really worked! That was the issue

Re: Heavy Forwarder not showing in Deployment Server

s2_splunk — Thu, 12 Oct 2017 21:08:19 GMT

Which one? restart or duplicate GUID?
I am converting my comment to an answer; please accept it to preserve for posterity. Thanks!

Re: Heavy Forwarder not showing in Deployment Server

ashish9433 — Fri, 13 Oct 2017 03:46:45 GMT

duplicate GUID was the issue & deleting the instance.cfg and restarting the service fixed the issue.