Deployment Architecture

Deployment Server not pushing apps to universal forwarder clients after Splunk 6.0 upgrade


I just upgraded the cluster (search head, indexers, heavy forwarders, etc except universal forwarders) to splunk 6.0. I have several new machines to add universal forwarders too, so I install the splunk universal forwarder 6.0 onto these new machines. However, these new machines don't seem to be getting the apps.

Other machines in the same server class continue to have the same apps (although these are universal forwarders v 5.0.4); furthermore, in the new forwarder management UI on my deployment server it says that the apps have been deployed for these new machines, which is clearly not true. Does anyone have any idea? I haven't changed anything except for installing the universal forwarder 6.0 onto the new machines.

EDIT: my deploymentclient.conf was configuered as such on the universal forwarders:
phoneHomeIntervalInSecs = 600

targetUri = x.x.x.x:8089

When I remove the phoneHomeIntervalSecs = 600, it worked and the apps got pushed. Why is this the case? In the documentation, phoneHomeIntervalSecs is a valid configuration line for the [deployment-client] stanza.

0 Karma


what sort of logging by deployment-client are you seeing in client splunkd.log between splunk service start and 600 seconds later? how long did you wait for changes to occur? how many concurrent clients is your deployment-server hosting (is it busy?)

0 Karma


This may not be the answer, but it is helpful to know about the log files.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...