Deployment Architecture

Deployment Monitor app not showing Forwarders but Deployment Server can see them

fernandoandre
Communicator

We have a server acting only as a Splunk Deployment Server v4.3.2 and we have activated Deployment Monitor v4.3.2. Our problem is that "Deployment Monitor -> Home", "Deployment Monitor -> All Forwarders", etc. doesn't show any data and no Forwarders contacting the Deployment Server.

However, by running "splunk list deploy-clients" the output shows all the splunk UFs we have installed. In fact, we have already deployed several configurations to the UFs and they are sending data to the Indexer (which is not the same server as the Deployment Server).

In Splunk Deployment Server logs we are unable to check anything that shows any clues to us. Does anyone faced this problem before?

Thank you in advance.

0 Karma
1 Solution

fernandoandre
Communicator

Problem solved.

Our approach was wrong. The Deployment Monitor has it's searches/dashboards based on splunk internal's indexes. Universal Forwarders send their own logs to the Indexer, and not to the Deployment Server (obvious!).

Therefore, the solution is to activate the Deployment Monitor on the Indexer instead of doing so in the Deployment Server. The latter will only work for deploying configs and not for monitoring the state of the UFs.

View solution in original post

0 Karma

fernandoandre
Communicator

Problem solved.

Our approach was wrong. The Deployment Monitor has it's searches/dashboards based on splunk internal's indexes. Universal Forwarders send their own logs to the Indexer, and not to the Deployment Server (obvious!).

Therefore, the solution is to activate the Deployment Monitor on the Indexer instead of doing so in the Deployment Server. The latter will only work for deploying configs and not for monitoring the state of the UFs.

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...