Deployment Architecture

How do I submit a ticket to support?

damonmanni
Path Finder

We are brand new Splunk Enterprise implementation here at macys.com. We are rolling out 100's of forwarders. I've had no issues until now:

We are deploying linux forwarders and I am now hitting an issue. Sometimes it works completely, but now I see many servers are not recv'ing the deployment dir of Splunk_TA_nix or the
/opt/splunkforwarder/etc/apps/macys_lorain_forwarder_outputs/local/outputs.conf

I've restart splunk svc's, redeploy, etc... several times with no luck. I check the deployment UI and it shows my new client (under Client Tab) as checked in but nothing under Apps.

Another anomaly in this is that we've noticed that it may take hours b/f some servers get the Splunk_TA_nix dir, which is not right of course.

I have the exact steps I use to deploy the linux forwarder if you need to review.

Why is this breaking all of a sudden?
We cannot move ahead w/ 90 more deployments with this current issue. Help is appreciated.
cheers,
Damon

Tags (1)
0 Karma

Pierceyuk
Path Finder

Try a search like "index=_* hostname" it might highlight issues with the connection/host to help troubleshoot

0 Karma

piebob
Splunk Employee
Splunk Employee

i've contacted the Support team, you should receive an email from them shortly.

0 Karma

lukejadamec
Super Champion

Log in to splunk.com, select Support > Support Portal
Or, call your sales rep.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...