topic Re: Connectivity Search in Splunk Search

Connectivity Search

troyredskins — Fri, 13 Aug 2021 19:34:04 GMT

I have an issue with the connectivity between the heavy forwarder and the deployment server. What is a search that I could use in the GUI to diagnose the issue?

Re: Connectivity Search

richgalloway — Sat, 14 Aug 2021 00:29:42 GMT

Look at splunkd.log on the DS and HF. They should explain the problem. Depending on the nature of the issue, you may have to sign in to the HF to access the log.

Re: Connectivity Search

SanjayReddy — Thu, 26 Aug 2021 15:39:42 GMT

hi @troyredskins

as a first check please verify connectity between HF---->DS by doing telnet from HF to deplotment server using following command.
if it is related to connectivity issue , it can resloved by enabling firewall between HF and DS.

command: telnet deplotmentserverip:portnumber (by default splunkd port number is 8089 but verify in deplotment server using (ps -ef | grep -i splunkd) )

example: telnet 127.0.0.1 8089

also verify deplotmentclient configuration on HF using command

$SPLUNK_HOME/bin/splunk show deploy-poll

if connecection is happening between HF and DS and as mentioned by @richgalloway
please search for DeploymentClient in splunkd.log on HF under $SPLUNK_HOME/var/log/splunk to check for WARN and ERROR messages.