Getting the below message post upgrade from 5.0.8 to 6.1.4 : FAILEDLOADDEPLOYMENTSERVER. ,please let me know how to get rid of this error and also the splunk refresh deploy-clients & splunk reload deploy-server are erroring out :
Socket error communicating with splunkd (error=The read operation timed out), path = /services/deployment/server/config/reload
Make sure you don't have any mistakes in your serverclass.conf. Since version 6.x Splunk is very strict with the config files.
For instance: when using a whit/black list, you can’t skip a number. this will fail to load thedeployment server
whitelist.0 = host3 whitelist.2 = host2 whitelist.3 = host1
And this will load
whitelist.0 = host3 whitelist.1 = host2 whitelist.2 = host1
It also can be you defined a app(location) that doesn't exist anymore. Deployment server also won't load in that situation
This is really a good information. I have got this Socket error as many times when I load. Restarting splunk too didnt solve the issue. After seeing this post, I realized that I have typed "[serverClass:appname]" as "[serverclass:appname]" in serverclass.conf file. Please note "C", it should be in upper case. After changing this, I could reload the splunk. Thanks for this very valuable information.
Check splunkd_stderr.log it will say which app or location doesn't exist anymore. Remove that from being referenced in the serverclass.conf and the problem will go away (had this issue today).
I am also seeing this issue
has the following message: FAILED_LOAD_DEPLOYMENT_SERVER
Has anyone found out what is causing this error?
I am running version 6.2.0 on the heavy forwarder that is giving this error.
Does any how to disable deployment server so that it does not try to start up?