Deployment Architecture

Deployment Server not pushing apps to universal forwarder clients after Splunk 6.0 upgrade

jonahtang
Explorer

I just upgraded the cluster (search head, indexers, heavy forwarders, etc except universal forwarders) to splunk 6.0. I have several new machines to add universal forwarders too, so I install the splunk universal forwarder 6.0 onto these new machines. However, these new machines don't seem to be getting the apps.

Other machines in the same server class continue to have the same apps (although these are universal forwarders v 5.0.4); furthermore, in the new forwarder management UI on my deployment server it says that the apps have been deployed for these new machines, which is clearly not true. Does anyone have any idea? I haven't changed anything except for installing the universal forwarder 6.0 onto the new machines.

EDIT: my deploymentclient.conf was configuered as such on the universal forwarders:
[deployment-client]
phoneHomeIntervalInSecs = 600

[target-broker:deploymentServer]
targetUri = x.x.x.x:8089

When I remove the phoneHomeIntervalSecs = 600, it worked and the apps got pushed. Why is this the case? In the documentation, phoneHomeIntervalSecs is a valid configuration line for the [deployment-client] stanza.

0 Karma

dstaulcu
Builder

what sort of logging by deployment-client are you seeing in client splunkd.log between splunk service start and 600 seconds later? how long did you wait for changes to occur? how many concurrent clients is your deployment-server hosting (is it busy?)

0 Karma

KpiBuff
Explorer

This may not be the answer, but it is helpful to know about the log files.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...