I have gone through all the related threads here but I can't find a possible solution to my version of this issue. I have a UF -> Intermediate forwarders -> Splunk Cloud setup. I have about 500+ UFs in my environment. I was working to update the certs used by the UF to self signed certs. I tested on a sample device and once validated that all works I renamed the app to what I wanted and pushed out the app to all my windows UFs. Turns out that I had an incorrect file path to my RootCA in server.conf. So, all my UFs can't connect to the DS to get the update app.
I hoped on a box that I have access to and can confirm that if I update the path, the UF checks in. So, for the 500+ UFs, I am really struggling to find a way to have them connect with the DS. I'm honestly not sure that is possible. The error that I is :
"DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected"
Outside of pushing a script with SCCM or like tools to uninstall the app and force a UF restart, which is going to be hell, I'm not sure what options i have. Are you good people here able to assist? I really need this one.
You don't have any other option so you need to use 3rd party tools like SCCM, Ansible etc. to remove/reinstall that faulty app and restart UF.
I have a simular issue and created a powershell script that i pushed from GPO on the windows host, and ansible for the linux host.
Took around 1-2 hour to get it up and working, alot faster then to deploy it manually on the 40 hosts i had.