I'm setting up a new deployment server. The server is a dedicated deployment server.
The only splunkforwarder that I have configured as a deployment client at this point is now sending this WARN to its splunkd.log.
DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected
I ran "splunk enable deploy-server" on the deployment server, then "splunk reload deploy-server" and everything in the deployment server logs look healthy.
However, on the forwarder the not_connected WARN still remains and has been joined by
License feature=DeployServer not enabled, cannot bring up Deployment Server
Why would that error come up on a forwarder/deployment client?
Guidance appreciated!
Karla
@di2esysadmin
I am not sure if you are still facing this issue.
You might want to check your server.conf and remove the following lines
[license]
active_group = Free
Way ahead... by three seconds 😛
Martin answered it! It was set to be its own license server. I pointed it to my indexer for its license and all is working great. Martin, awesome. Thank you. If you copy this into the answer box I'll vote for it as best answer.
Judging by that comment I'm going with "license issue".
The DeployServer feature is only available with Splunk Enterprise (or Trial) licenses, so forwarders or Splunk Free licensed instances aren't able to run a deployment server.
You can set up that deployment server instance as a license slave, connecting to the Splunk instance with an Enterprise license that will act as a license master.
Ah. Interesting question. I haven't installed a license on it. It was a universal forwarder before today when I installed the full 6.0.1 splunk on it. It's not the indexer or the web search head. Can I put the same enterprise license on it that is on the indexer? Is that what I have to do to get this to work?
What license type are you using on your deployment server?
I just turned up logging on both the deployment client and server . . . we'll see if that sheds any light on what's going on.
I added the following to deploymentserver.conf
[serverClass:all_forwarder]
whitelist.0 = *
[serverClass:all_forwarder:app:forwarders]
restartSplunkd = true
stateOnClient = enabled
I did this based on mship's answer here: http://answers.splunk.com/answers/28797/deploymentclient-unable-to-send-handshake-message
The forwarder/deploymentclient log now says its downloading the all_forwarder:forwarders bundle before I get the two errors. I don't know if this is progress or not.