We have 300+ servers in our environment and already reporting to Splunk. We are trying to add 5 more servers but the communication between deployment client and deployment server is not getting established. Below is netstat output from deployment server.
Proto Local Address Foreign Address State
TCP A.B.C.D:3389 ABC:65062 ESTABLISHED
TCP A.B.C.D:8089 10.1.1.1:56008 TIMEWAIT
TCP A.B.C.D:8089 22.214.171.124:56671 TIMEWAIT
TCP A.B.C.D:8089 126.96.36.199:56673 TIME_WAIT
We have checked telnet on port 8089 is working in both ways. Can you please suggests some checks that we should perform?
Thanks in advance.
If you can telnet but DC cannot get to DS then the only thing that makes sense is that you have 2 NICs on that server and you are using one (that works) and Splunk is locked to the other (that is missing a route or ACL or something).
Hi, Thanks for your suggestion. We checked this on the server with single nic but issue persisted. Later, When I installed older version of universal forwarder on the server, it started to report. Now, I suspect issue is with version compatibility .We are running 6.3.1 version of Deployment server, and were installing the latest versions of Universal forwarder on server. I need to check again by installing older versions of universal forwarder on other servers. Hoping for positive result.
Hi All, Issue got resolved when I installed older version of Splunk universal forwarder. DS was running on 6.3.1 while I was installing latest versions of Splunk UF. Downgrading them to 6.3.1 worked.