Deployment Architecture

Deployment Monitor app not showing Forwarders but Deployment Server can see them

fernandoandre
Communicator

We have a server acting only as a Splunk Deployment Server v4.3.2 and we have activated Deployment Monitor v4.3.2. Our problem is that "Deployment Monitor -> Home", "Deployment Monitor -> All Forwarders", etc. doesn't show any data and no Forwarders contacting the Deployment Server.

However, by running "splunk list deploy-clients" the output shows all the splunk UFs we have installed. In fact, we have already deployed several configurations to the UFs and they are sending data to the Indexer (which is not the same server as the Deployment Server).

In Splunk Deployment Server logs we are unable to check anything that shows any clues to us. Does anyone faced this problem before?

Thank you in advance.

0 Karma
1 Solution

fernandoandre
Communicator

Problem solved.

Our approach was wrong. The Deployment Monitor has it's searches/dashboards based on splunk internal's indexes. Universal Forwarders send their own logs to the Indexer, and not to the Deployment Server (obvious!).

Therefore, the solution is to activate the Deployment Monitor on the Indexer instead of doing so in the Deployment Server. The latter will only work for deploying configs and not for monitoring the state of the UFs.

View solution in original post

0 Karma

fernandoandre
Communicator

Problem solved.

Our approach was wrong. The Deployment Monitor has it's searches/dashboards based on splunk internal's indexes. Universal Forwarders send their own logs to the Indexer, and not to the Deployment Server (obvious!).

Therefore, the solution is to activate the Deployment Monitor on the Indexer instead of doing so in the Deployment Server. The latter will only work for deploying configs and not for monitoring the state of the UFs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...