Deployment Architecture

Deployment Monitor app not showing Forwarders but Deployment Server can see them

fernandoandre
Communicator

We have a server acting only as a Splunk Deployment Server v4.3.2 and we have activated Deployment Monitor v4.3.2. Our problem is that "Deployment Monitor -> Home", "Deployment Monitor -> All Forwarders", etc. doesn't show any data and no Forwarders contacting the Deployment Server.

However, by running "splunk list deploy-clients" the output shows all the splunk UFs we have installed. In fact, we have already deployed several configurations to the UFs and they are sending data to the Indexer (which is not the same server as the Deployment Server).

In Splunk Deployment Server logs we are unable to check anything that shows any clues to us. Does anyone faced this problem before?

Thank you in advance.

0 Karma
1 Solution

fernandoandre
Communicator

Problem solved.

Our approach was wrong. The Deployment Monitor has it's searches/dashboards based on splunk internal's indexes. Universal Forwarders send their own logs to the Indexer, and not to the Deployment Server (obvious!).

Therefore, the solution is to activate the Deployment Monitor on the Indexer instead of doing so in the Deployment Server. The latter will only work for deploying configs and not for monitoring the state of the UFs.

View solution in original post

0 Karma

fernandoandre
Communicator

Problem solved.

Our approach was wrong. The Deployment Monitor has it's searches/dashboards based on splunk internal's indexes. Universal Forwarders send their own logs to the Indexer, and not to the Deployment Server (obvious!).

Therefore, the solution is to activate the Deployment Monitor on the Indexer instead of doing so in the Deployment Server. The latter will only work for deploying configs and not for monitoring the state of the UFs.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...