In forwarder management I get a message stating there are 6 clients with "DEPLOYMENT ERRORS" but cannot find the issue. Searched the _internal index but still do not see what the errors are.
Where can I find the client errors?
run the search
index=_internal sourcetype=splunkd fail
The return will have information to narrow the search for the clients that have problems.
This is my way of finding out who is that has issue:
1st , search this in deployment server:
index=_internal sourcetype=splunkd record (New OR Updating) result=Fail | head 100
You should be able to see name of the client along with application and server class.
you can get the system name of the server, by Settings > Forwarder Management > Clients Tab, then paste name of the client.
You could continue your troubleshooting from there.