Communication between deployment server and client is not established.

[swapsplunk236]

Hi All,

We have 300+ servers in our environment and already reporting to Splunk. We are trying to add 5 more servers but the communication between deployment client and deployment server is not getting established. Below is netstat output from deployment server.

Active Connections

Proto Local Address Foreign Address State
TCP A.B.C.D:3389 ABC:65062 ESTABLISHED
TCP A.B.C.D:8089 10.1.1.1:56008 TIME_WAIT
TCP A.B.C.D:8089 1.2.2.4:56671 TIME_WAIT
TCP A.B.C.D:8089 2.2.3.4:56673 TIME_WAIT

We have checked telnet on port 8089 is working in both ways. Can you please suggests some checks that we should perform?

Thanks in advance.

[swapsplunk236 · Accepted solution]

Hi All, Issue got resolved when I installed older version of Splunk universal forwarder. DS was running on 6.3.1 while I was installing latest versions of Splunk UF. Downgrading them to 6.3.1 worked.

[woodcock]

If you can telnet but DC cannot get to DS then the only thing that makes sense is that you have 2 NICs on that server and you are using one (that works) and Splunk is locked to the other (that is missing a route or ACL or something).

[swapsplunk236]

Hi, Thanks for your suggestion. We checked this on the server with single nic but issue persisted. Later, When I installed older version of universal forwarder on the server, it started to report. Now, I suspect issue is with version compatibility .We are running 6.3.1 version of Deployment server, and were installing the latest versions of Universal forwarder on server. I need to check again by installing older versions of universal forwarder on other servers. Hoping for positive result.