All Apps and Add-ons

Using Splunk in Docker, Enterprise keeps saying no forwarders configured as deployment clients

beetaj
Explorer

Hi all,
Please I need help on something seems quite common but I cannot find immediate online documentation even though I have tried different solutions.
I have installed enterprise server with this command working fine up an running:
docker run
--net splunk
--hostname splunkenterprise
--name splunkenterprise

-p 9997:9997 -p 8000:8000 -p 8088:8088
-e "SPLUNK_START_ARGS=--accept-license" --env "SPLUNK_ENABLE_LISTEN=9997"
--env "SPLUNK_PASSWORD=testpass"
splunk/splunk

Then I installed universalforwarder with this command working fine (no error and healthy):
docker run
--net splunk
--hostname forwarder
--name forwarder
-e SPLUNK_START_ARGS=--accept-license
-e SPLUNK_FORWARD_SERVER='splunkenterprise:9997'

--env SPLUNK_PASSWORD=testPass
-e SPLUNK_RECEIVING_INDEXER='splunkenterprise:9997'
splunk/universalforwarder

The problem I have is that my enterprise server cannot see any forwarders, showing:
"There are currently no forwarders configured as deployment clients to this instance."

I have spent a day and tried different solutions i.e. editing the forwarder's outputs.conf file manually, but apparently the problem is that forwarders should be configured as deployment clients??
Please help.
Thanks.

Tags (1)
0 Karma
1 Solution

beetaj
Explorer

Ok, I am updating this for future if anyone visits this question:
The issue is resolved by changing the forwarder docker run command as below:

docker run
--net splunk
--hostname forwarder
--name forwarder
-e SPLUNK_START_ARGS=--accept-license
-e SPLUNK_FORWARD_SERVER='splunkenterprise:9997'
--env SPLUNK_PASSWORD=myPass
-e SPLUNK_RECEIVING_INDEXER='splunkenterprise:9997'
-e SPLUNK_DEPLOYMENT_SERVER='splunkenterprise'
-e DEPLOYMENT_SERVER='splunkenterprise'
-e RECEIVING_SERVER=splunkenterprise
splunk/universalforwarder

The fix is that the -e SPLUNK_DEPLOYMENT_SERVER='splunkenterprise' doesn't need the default port 8089 to be supplied.

View solution in original post

0 Karma

beetaj
Explorer

Ok, I am updating this for future if anyone visits this question:
The issue is resolved by changing the forwarder docker run command as below:

docker run
--net splunk
--hostname forwarder
--name forwarder
-e SPLUNK_START_ARGS=--accept-license
-e SPLUNK_FORWARD_SERVER='splunkenterprise:9997'
--env SPLUNK_PASSWORD=myPass
-e SPLUNK_RECEIVING_INDEXER='splunkenterprise:9997'
-e SPLUNK_DEPLOYMENT_SERVER='splunkenterprise'
-e DEPLOYMENT_SERVER='splunkenterprise'
-e RECEIVING_SERVER=splunkenterprise
splunk/universalforwarder

The fix is that the -e SPLUNK_DEPLOYMENT_SERVER='splunkenterprise' doesn't need the default port 8089 to be supplied.

0 Karma

beetaj
Explorer

I tried also supplying SPLUNK_DEPLOYMENT_SERVER in the forwarder startup command, but forwarder on standing up gets fatal error like this:
{
"attempts": 50,
"changed": false,
"content": "",
"msg": "Status code was -1 and not [200]: Request failed: ",
"redirected": false,
"status": -1,
"url": "https://splunkenterprise:8089:8089/services/server/info?output_mode=json"
}

The question is that by default it uses 'https' which is not correct.
how do I fix this?

Thanks

0 Karma

beetaj
Explorer

@p_gurav ,

I forgot to mention that my deploymentclient.conf file looks like this:
[deployment-client]

[target-broker:deploymentServer]
targetUri = splunkenterprise:8089

0 Karma

p_gurav
Champion

Hi Beetej,

You need to configure deploymentclient.conf on your forwarder docker. Please find below doc for the same:
https://docs.splunk.com/Documentation/Splunk/7.2.6/Updating/Configuredeploymentclients

0 Karma

beetaj
Explorer

Thanks @p_gurav ,
I now added a new deploymentclient.conf to my forwarder container (didn't exist one before here /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/deploymentclient.conf)
Then restarted my forwarder and enterprise, unfortunately still no sign of forwarder on the front end.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...