Deployment Architecture

Forwarder not appearing in unix app

ylsul
Explorer

Hi,
I have a universal forwarder that sends information to my indexer. Both have the *nix app installed.

From the deployment monitor, I can see the forwarder sending data to the indexer, but this host never appears in the *nix list of hosts.

Is there something I need to do to get the unix app to recognize this forwarder?

Tags (2)

pickerin
Path Finder

I have the answer!

The Unix App will not see new hosts until you MANUALLY add them to a Category / Group (under Settings > Categories)

0 Karma

pickerin
Path Finder

Old post, but no answers, and I'm having the same problem. Have followed all of the documentation. Host appears as a Forwarder, but does not appear in the Unix App. Nothing I do seems to help.

Even built a deployment server, and redeployed the application that way, no luck.

0 Karma

ylsul
Explorer

I installed another universal forwarder on another host. I also installed the unix Technical Addon in my forwarder.

Same deal, however: The Deployment monitor sees data being passed through, but the Unix app on the indexer never updates. The only host listed is itself.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...