Using Splunk in Docker, Enterprise keeps saying no forwarders configured as deployment clients

[beetaj]

Hi all,
Please I need help on something seems quite common but I cannot find immediate online documentation even though I have tried different solutions.
I have installed enterprise server with this command working fine up an running:
docker run
--net splunk
--hostname splunkenterprise
--name splunkenterprise

-p 9997:9997 -p 8000:8000 -p 8088:8088
-e "SPLUNK_START_ARGS=--accept-license" --env "SPLUNK_ENABLE_LISTEN=9997"
--env "SPLUNK_PASSWORD=testpass"
splunk/splunk

Then I installed universalforwarder with this command working fine (no error and healthy):
docker run
--net splunk
--hostname forwarder
--name forwarder
-e SPLUNK_START_ARGS=--accept-license
-e SPLUNK_FORWARD_SERVER='splunkenterprise:9997'

--env SPLUNK_PASSWORD=testPass
-e SPLUNK_RECEIVING_INDEXER='splunkenterprise:9997'
splunk/universalforwarder

The problem I have is that my enterprise server cannot see any forwarders, showing:
"There are currently no forwarders configured as deployment clients to this instance."

I have spent a day and tried different solutions i.e. editing the forwarder's outputs.conf file manually, but apparently the problem is that forwarders should be configured as deployment clients??
Please help.
Thanks.

[beetaj · Accepted solution]

Ok, I am updating this for future if anyone visits this question:
The issue is resolved by changing the forwarder docker run command as below:

docker run
--net splunk
--hostname forwarder
--name forwarder
-e SPLUNK_START_ARGS=--accept-license
-e SPLUNK_FORWARD_SERVER='splunkenterprise:9997'
--env SPLUNK_PASSWORD=myPass
-e SPLUNK_RECEIVING_INDEXER='splunkenterprise:9997'
-e SPLUNK_DEPLOYMENT_SERVER='splunkenterprise'
-e DEPLOYMENT_SERVER='splunkenterprise'
-e RECEIVING_SERVER=splunkenterprise
splunk/universalforwarder

The fix is that the -e SPLUNK_DEPLOYMENT_SERVER='splunkenterprise' doesn't need the default port 8089 to be supplied.

[beetaj]

I tried also supplying SPLUNK_DEPLOYMENT_SERVER in the forwarder startup command, but forwarder on standing up gets fatal error like this:
{
"attempts": 50,
"changed": false,
"content": "",
"msg": "Status code was -1 and not [200]: Request failed: ",
"redirected": false,
"status": -1,
"url": "https://splunkenterprise:8089:8089/services/server/info?output_mode=json"
}

The question is that by default it uses 'https' which is not correct.
how do I fix this?

Thanks

[beetaj]

@p_gurav ,

I forgot to mention that my deploymentclient.conf file looks like this:
[deployment-client]

[target-broker:deploymentServer]
targetUri = splunkenterprise:8089

[p_gurav]

Hi Beetej,

You need to configure deploymentclient.conf on your forwarder docker. Please find below doc for the same:
https://docs.splunk.com/Documentation/Splunk/7.2.6/Updating/Configuredeploymentclients

[beetaj]

Thanks @p_gurav ,
I now added a new deploymentclient.conf to my forwarder container (didn't exist one before here /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/deploymentclient.conf)
Then restarted my forwarder and enterprise, unfortunately still no sign of forwarder on the front end.