Deployment Architecture
Highlighted

Forwarder Management troubleshooting client errors

Engager

In forwarder management I get a message stating there are 6 clients with "DEPLOYMENT ERRORS" but cannot find the issue. Searched the _internal index but still do not see what the errors are.

Where can I find the client errors?

Highlighted

Re: Forwarder Management troubleshooting client errors

Explorer

run the search
index=_internal sourcetype=splunkd fail

The return will have information to narrow the search for the clients that have problems.

Highlighted

Re: Forwarder Management troubleshooting client errors

New Member

This is one reason I am starting to NOT like Splunk many unanswered questions. I too am having this problem.

0 Karma
Highlighted

Re: Forwarder Management troubleshooting client errors

Contributor

This is my way of finding out who is that has issue:
1st , search this in deployment server:

index=_internal sourcetype=splunkd record (New OR Updating) result=Fail | head 100

You should be able to see name of the client along with application and server class.
you can get the system name of the server, by Settings > Forwarder Management > Clients Tab, then paste name of the client.

You could continue your troubleshooting from there.

Highlighted

Re: Forwarder Management troubleshooting client errors

Motivator

This answer greatly helped, thanks.

0 Karma