Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Forwarder management error
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Forwarder management error
I am getting the below error
The forwarder management interface does not support some settings in your serverclass.conf file. The interface is now read-only.
I was just navigating through the UI and tried creating a new serverclass but did not save anything but still the serverclass is showing in the deployment server.I tried deleting through the CLI in the serverclass.conf but I have not seen that
I have read in some post that it is because of filterType this causes the error.Any suggestions what is the best solution.Below is the stanza I have in few serverclass amd similar issue
machineTypesFilter = linux-i686,linux-x86_64,
https://answers.splunk.com/answers/185547/forwarder-management-issue.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I figured it out .The app created is under
/opt/splunk/etc/apps/search/local/serverclass.conf .I deleted the and the error has gone
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think the message you are seeing is expected on deployment server, you can't manage all the configs via deployment server web-interface..
check you repositoryLocation on your deloyment server(they usually reside under $SPLUNK_HOME/etc/deployment-apps), whereas on deployment clients they are downloaded under $SPLUNK_HOME/etc/apps
https://docs.splunk.com/Documentation/Splunk/7.2.1/Updating/Createdeploymentapps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What should I need to check specifically
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As you deleted the server class from CLI and If you are still seeing the serverclass you created from deployment-server UI, I would restart splunkd on deployment-server.
what's the exact error you are seeing..??
did you follow the splunkanswers resolution you posted in your question..??
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
