Deployment Architecture

Deployment Clients can't check in to Deployment Server

Olamide22
Explorer

All,

I have gone through all the related threads here but I can't find a possible solution to my version of this issue. I have a UF -> Intermediate forwarders -> Splunk Cloud setup. I have about 500+ UFs in my environment. I was working to update the certs used by the UF to self signed certs. I tested on a sample device and once validated that all works I renamed the app to what I wanted and pushed out the app to all my windows UFs. Turns out that I had an incorrect file path to my RootCA in server.conf. So, all my UFs can't connect to the DS to get the update app.

I hoped on a box that I have access to and can confirm that if I update the path, the UF checks in. So, for the 500+ UFs, I am really struggling to find a way to have them connect with the DS. I'm honestly not sure that is possible. The error that I is :

"DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected"

Outside of pushing a script with SCCM or like tools to uninstall the app and force a UF restart, which is going to be hell, I'm not sure what options i have. Are you good people here able to assist? I really need this one.

Thanks.

0 Karma

broberg
Communicator

Ouch.
I have a simular issue and created a powershell script that i pushed from GPO on the windows host, and ansible for the linux host.
Took around 1-2 hour to get it up and working, alot faster then to deploy it manually on the 40 hosts i had.

0 Karma

Olamide22
Explorer

Thanks. This is probably the direction I will go.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

You don't have any other option so you need to use 3rd party tools like SCCM, Ansible etc. to remove/reinstall that faulty app and restart UF.

0 Karma

Olamide22
Explorer

I figured as much. Just wanted to check if there was a chance there is another option. Thanks.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!