Blank Forwarder Management page on Splunk 6

[rabitoblanco]

I was using the Forwarder Management page just fine, and at some point found the page had gone blank. Any ideas?

I am seeing the nav panel on the top and the About, Support, File a Bug, Documentation, Privacy Policy on the bottom. Nothing else. I have made no significant changes since it was functioning correctly.

[I have already restarted the instance, reloaded the serverclass, checked to make sure all the other views under settings are working just fine]

[pasokkum]

I referred the below link and checked on the List of incompatibilities between the old serverclass.conf and what is supported by Forwarder Management.On commenting the unsupported attributes in serverclass.conf the Forwarder management page is showing details.

[global]

whitelist.0 = *

restartSplunkd = true

stateOnClient = enabled

disabled = true

https://answers.splunk.com/answers/185547/forwarder-management-issue.html
http://docs.splunk.com/Documentation/Splunk/6.2.1/Updating/Forwardermanagementcompatibility#List_of_...

[rabitoblanco · Accepted solution]

I have found that the blank Forwarder Management page usually means there is a parameter in the serverclass.conf file (in $SPLUNK_HOME/etc/system/local) that is not supported in the UI.
Error seen here will occur if:
- Specifying a default value explicitly in serverclass.conf (restartSplunkd=false for example-- bc/ that is the default).
- Apps you have specified to be deployed in your serverclass.conf do not exist in the SPLUNK_HOME/etc/deployment-apps directory . (Hint: if you rename something after deploying via UI, the same condition exists)

[ShaneF]

So I was having this problem this evening and it happened to be a server class that had nothing listed under it inside the -- /etc/splunk/etc/system/local/serverclass.conf -- restarted splunkd and it worked again.

I manually edited this file and that works fine.

Having a server class listed with nothing underneath it including servers listed will cause all other servers to stop phoning home.

[rabitoblanco]

Thanks for the tip!

I think it's a bit different what you were seeing-- where you see no clients phoning home (if I understand correctly). What you get if your mess up your sc.conf is a completely blank Forwarder Management page-- no columns or anything.

[ShaneF]

Correct. In my case with blank service class clients will not phone home, but Splunk will "work" just not in deployment of apps/scripts, etc. Another case scenario if it happens to someone else.

[rabitoblanco]

Were you using the CLI to edit your serverclass.conf?

I have found that the blank Forwarder Management page usually means there is a parameter in the serverclass.conf that is not supported in the UI.

I have also seen this issue when specifying a default value explicitly (restartSplunkd=false for example-- bc/ that is the default).
You can also check to make sure that all the Apps you have specified to be deployed in your serverclass.conf actually exist in the SPLUNK_HOME/etc/deployment-apps directory .

[gbowden_pheaa]

I have opened a ticket for this, if I get an answer I'll post it here. I am having this issue, it is browser independent, and restart the deployment server through either a full restart or reload deploy-server is not working. This is brand new installation, load is not an issue (12 clients).

[gbowden_pheaa]

This got me going - thank you!

I was editing only the deployment-apps directory. I renamed the serverclass.conf file and restarted Splunk, that got me going again. I am rebuilding this file through the GUI, I read somewhere you shouldn't edit the serverclass.conf file for just this reason. Apparently, one must be careful will the deployment-apps directory also!

Thanks again!

[rabitoblanco]

Were you using the CLI to edit your serverclass.conf?

I have found that the blank Forwarder Management page usually means there is a parameter in the serverclass.conf that is not supported in the UI.

I have also seen this issue when specifying a default value explicitly (restartSplunkd=false for example-- bc/ that is the default).
You can also check to make sure that all the Apps you have specified to be deployed in your serverclass.conf actually exist in the SPLUNK_HOME/etc/deployment-apps directory .

[tprzelom]

Splunk 6.0.3
Chrome Version 34.0.1847.137

~10,000 clients

Same issue

Restarting the deployment server has worked for me twice
/opt/splunk/bin/splunk restart

The restart will drop the list of clients that have checked in so you'll need to wait for a client to tag home before you can look at it through the forwarder management screen.

[somesoni2]

Are you using IE 8?

[dstaulcu]

FYI - We're experiencing that too. How heavily loaded is your deployment server? Our theory was that it had something to do with load as the behavior is intermittent.