Deployment Architecture

Deployment Server not pushing apps to universal forwarder clients after Splunk 6.0 upgrade


I just upgraded the cluster (search head, indexers, heavy forwarders, etc except universal forwarders) to splunk 6.0. I have several new machines to add universal forwarders too, so I install the splunk universal forwarder 6.0 onto these new machines. However, these new machines don't seem to be getting the apps.

Other machines in the same server class continue to have the same apps (although these are universal forwarders v 5.0.4); furthermore, in the new forwarder management UI on my deployment server it says that the apps have been deployed for these new machines, which is clearly not true. Does anyone have any idea? I haven't changed anything except for installing the universal forwarder 6.0 onto the new machines.

EDIT: my deploymentclient.conf was configuered as such on the universal forwarders:
phoneHomeIntervalInSecs = 600

targetUri = x.x.x.x:8089

When I remove the phoneHomeIntervalSecs = 600, it worked and the apps got pushed. Why is this the case? In the documentation, phoneHomeIntervalSecs is a valid configuration line for the [deployment-client] stanza.

0 Karma


what sort of logging by deployment-client are you seeing in client splunkd.log between splunk service start and 600 seconds later? how long did you wait for changes to occur? how many concurrent clients is your deployment-server hosting (is it busy?)

0 Karma


This may not be the answer, but it is helpful to know about the log files.

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...