Deployment Architecture

Blank Forwarder Management page on Splunk 6

rabitoblanco
Path Finder

I was using the Forwarder Management page just fine, and at some point found the page had gone blank. Any ideas?

I am seeing the nav panel on the top and the About, Support, File a Bug, Documentation, Privacy Policy on the bottom. Nothing else. I have made no significant changes since it was functioning correctly.

[I have already restarted the instance, reloaded the serverclass, checked to make sure all the other views under settings are working just fine]

1 Solution

rabitoblanco
Path Finder

I have found that the blank Forwarder Management page usually means there is a parameter in the serverclass.conf file (in $SPLUNK_HOME/etc/system/local) that is not supported in the UI.
Error seen here will occur if:
- Specifying a default value explicitly in serverclass.conf (restartSplunkd=false for example-- bc/ that is the default).
- Apps you have specified to be deployed in your serverclass.conf do not exist in the SPLUNK_HOME/etc/deployment-apps directory . (Hint: if you rename something after deploying via UI, the same condition exists)

View solution in original post

0 Karma

pasokkum
Path Finder

I referred the below link and checked on the List of incompatibilities between the old serverclass.conf and what is supported by Forwarder Management.On commenting the unsupported attributes in serverclass.conf the Forwarder management page is showing details.

[global]

whitelist.0 = *

restartSplunkd = true

stateOnClient = enabled

disabled = true

https://answers.splunk.com/answers/185547/forwarder-management-issue.html
http://docs.splunk.com/Documentation/Splunk/6.2.1/Updating/Forwardermanagementcompatibility#List_of_...

0 Karma

rabitoblanco
Path Finder

I have found that the blank Forwarder Management page usually means there is a parameter in the serverclass.conf file (in $SPLUNK_HOME/etc/system/local) that is not supported in the UI.
Error seen here will occur if:
- Specifying a default value explicitly in serverclass.conf (restartSplunkd=false for example-- bc/ that is the default).
- Apps you have specified to be deployed in your serverclass.conf do not exist in the SPLUNK_HOME/etc/deployment-apps directory . (Hint: if you rename something after deploying via UI, the same condition exists)

0 Karma

ShaneF
Explorer

So I was having this problem this evening and it happened to be a server class that had nothing listed under it inside the -- /etc/splunk/etc/system/local/serverclass.conf -- restarted splunkd and it worked again.

I manually edited this file and that works fine.

Having a server class listed with nothing underneath it including servers listed will cause all other servers to stop phoning home.

0 Karma

rabitoblanco
Path Finder

Thanks for the tip!

I think it's a bit different what you were seeing-- where you see no clients phoning home (if I understand correctly). What you get if your mess up your sc.conf is a completely blank Forwarder Management page-- no columns or anything.

0 Karma

ShaneF
Explorer

Correct. In my case with blank service class clients will not phone home, but Splunk will "work" just not in deployment of apps/scripts, etc. Another case scenario if it happens to someone else.

0 Karma

rabitoblanco
Path Finder

Were you using the CLI to edit your serverclass.conf?

I have found that the blank Forwarder Management page usually means there is a parameter in the serverclass.conf that is not supported in the UI.

I have also seen this issue when specifying a default value explicitly (restartSplunkd=false for example-- bc/ that is the default).
You can also check to make sure that all the Apps you have specified to be deployed in your serverclass.conf actually exist in the SPLUNK_HOME/etc/deployment-apps directory .

0 Karma

gbowden_pheaa
Path Finder

I have opened a ticket for this, if I get an answer I'll post it here. I am having this issue, it is browser independent, and restart the deployment server through either a full restart or reload deploy-server is not working. This is brand new installation, load is not an issue (12 clients).

0 Karma

gbowden_pheaa
Path Finder

This got me going - thank you!

I was editing only the deployment-apps directory. I renamed the serverclass.conf file and restarted Splunk, that got me going again. I am rebuilding this file through the GUI, I read somewhere you shouldn't edit the serverclass.conf file for just this reason. Apparently, one must be careful will the deployment-apps directory also!

Thanks again!

0 Karma

rabitoblanco
Path Finder

Were you using the CLI to edit your serverclass.conf?

I have found that the blank Forwarder Management page usually means there is a parameter in the serverclass.conf that is not supported in the UI.

I have also seen this issue when specifying a default value explicitly (restartSplunkd=false for example-- bc/ that is the default).
You can also check to make sure that all the Apps you have specified to be deployed in your serverclass.conf actually exist in the SPLUNK_HOME/etc/deployment-apps directory .

tprzelom
Path Finder

Splunk 6.0.3
Chrome Version 34.0.1847.137

~10,000 clients

Same issue

Restarting the deployment server has worked for me twice
/opt/splunk/bin/splunk restart

The restart will drop the list of clients that have checked in so you'll need to wait for a client to tag home before you can look at it through the forwarder management screen.

0 Karma

somesoni2
Revered Legend

Are you using IE 8?

0 Karma

dstaulcu
Builder

FYI - We're experiencing that too. How heavily loaded is your deployment server? Our theory was that it had something to do with load as the behavior is intermittent.

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...