Deployment Architecture

Forwarder& DeploymentClient log contains "License feature=DeployServer not enabled"

di2esysadmin
Path Finder

I'm setting up a new deployment server. The server is a dedicated deployment server.

The only splunkforwarder that I have configured as a deployment client at this point is now sending this WARN to its splunkd.log.

DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected

I ran "splunk enable deploy-server" on the deployment server, then "splunk reload deploy-server" and everything in the deployment server logs look healthy.

However, on the forwarder the not_connected WARN still remains and has been joined by

License feature=DeployServer not enabled, cannot bring up Deployment Server

Why would that error come up on a forwarder/deployment client?

Guidance appreciated!

Karla

0 Karma

vr2312
Contributor

@di2esysadmin
I am not sure if you are still facing this issue.

You might want to check your server.conf and remove the following lines

[license]
active_group = Free

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Way ahead... by three seconds 😛

0 Karma

di2esysadmin
Path Finder

Martin answered it! It was set to be its own license server. I pointed it to my indexer for its license and all is working great. Martin, awesome. Thank you. If you copy this into the answer box I'll vote for it as best answer.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Judging by that comment I'm going with "license issue".

The DeployServer feature is only available with Splunk Enterprise (or Trial) licenses, so forwarders or Splunk Free licensed instances aren't able to run a deployment server.

You can set up that deployment server instance as a license slave, connecting to the Splunk instance with an Enterprise license that will act as a license master.

di2esysadmin
Path Finder

Ah. Interesting question. I haven't installed a license on it. It was a universal forwarder before today when I installed the full 6.0.1 splunk on it. It's not the indexer or the web search head. Can I put the same enterprise license on it that is on the indexer? Is that what I have to do to get this to work?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What license type are you using on your deployment server?

0 Karma

di2esysadmin
Path Finder

I just turned up logging on both the deployment client and server . . . we'll see if that sheds any light on what's going on.

0 Karma

di2esysadmin
Path Finder

I added the following to deploymentserver.conf

[serverClass:all_forwarder] 
whitelist.0 = *
[serverClass:all_forwarder:app:forwarders]
restartSplunkd = true
stateOnClient = enabled

I did this based on mship's answer here: http://answers.splunk.com/answers/28797/deploymentclient-unable-to-send-handshake-message

The forwarder/deploymentclient log now says its downloading the all_forwarder:forwarders bundle before I get the two errors. I don't know if this is progress or not.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...