Deployment Architecture

Deployment Monitor best practices

Path Finder

I'm getting some weird behavior with the Deployment monitor app. I've got two servers in our DMZ that act receive data from forwarders at another data center.

When I look at the "All Forwarders" tab, it shows one of the DMZ hosts twice, but not the other one. When I do a check from the command line from a host in the remote data center, it shows that forwarding is working properly.

So, my question is, why is one host showing up twice and not the other? I've confirmed that they have different hostnames defined in inputs.conf and server.conf. The other question is, do I need to run the Deployment Monitor on all forwarders? If not, then why can I only see the two forwarders that are forwarding directly to the central server and not any of the 3rd tier servers?



0 Karma

Splunk Employee
Splunk Employee

This is pretty strange behavior, and I don't think I can diagnose it without taking a look at your enviroment. Can you please open a support case?

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...