Deployment clients logging

[Starlette]

Is the component in _internal dropped for the deployment clients connects ( component DeploymenServer) ?

I believe that to get the client you could use :

index=_internal source=splunkd.log component="DeploymentServer" | dedup hostname | table hostname

[sowings]

The clients themselves will log events as DeploymentClient (typically when the server has issued splunk reload deploy-server to update the class definitions. It will also log DeployedApplication when the client has downloaded and installed a new app.

The server will log PackageDownloadRestHandler messages in splunkd.log (including the IP of the client) when a client downloads an application. The server also logs client connections (even when no apps are being deployed) in splunkd_access.log, with the 'phonehome' keyword. Information about the client is logged here, such as its IP, server name (as defined in server.conf), etc.

[Starlette]

yeah, or is ariving at the deploymentbox, i can control them now but was focus on the component deploymentserver which is gone in splunk.d log

[sowings]

Components are gone? Perhaps I misunderstood the nature of your question? What exactly are you trying to figure out? Whether an individual client has connected?

[Starlette]

cool, indeed it looks like the components are gone,,,,guess time for a deployment config monitor?