Deployment Architecture

Deployment Clients can't check in to Deployment Server

Olamide22
Explorer

All,

I have gone through all the related threads here but I can't find a possible solution to my version of this issue. I have a UF -> Intermediate forwarders -> Splunk Cloud setup. I have about 500+ UFs in my environment. I was working to update the certs used by the UF to self signed certs. I tested on a sample device and once validated that all works I renamed the app to what I wanted and pushed out the app to all my windows UFs. Turns out that I had an incorrect file path to my RootCA in server.conf. So, all my UFs can't connect to the DS to get the update app.

I hoped on a box that I have access to and can confirm that if I update the path, the UF checks in. So, for the 500+ UFs, I am really struggling to find a way to have them connect with the DS. I'm honestly not sure that is possible. The error that I is :

"DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected"

Outside of pushing a script with SCCM or like tools to uninstall the app and force a UF restart, which is going to be hell, I'm not sure what options i have. Are you good people here able to assist? I really need this one.

Thanks.

0 Karma

broberg
Communicator

Ouch.
I have a simular issue and created a powershell script that i pushed from GPO on the windows host, and ansible for the linux host.
Took around 1-2 hour to get it up and working, alot faster then to deploy it manually on the 40 hosts i had.

0 Karma

Olamide22
Explorer

Thanks. This is probably the direction I will go.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

You don't have any other option so you need to use 3rd party tools like SCCM, Ansible etc. to remove/reinstall that faulty app and restart UF.

0 Karma

Olamide22
Explorer

I figured as much. Just wanted to check if there was a chance there is another option. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...