Deployment Architecture

How do I submit a ticket to support?

damonmanni
Path Finder

We are brand new Splunk Enterprise implementation here at macys.com. We are rolling out 100's of forwarders. I've had no issues until now:

We are deploying linux forwarders and I am now hitting an issue. Sometimes it works completely, but now I see many servers are not recv'ing the deployment dir of Splunk_TA_nix or the
/opt/splunkforwarder/etc/apps/macys_lorain_forwarder_outputs/local/outputs.conf

I've restart splunk svc's, redeploy, etc... several times with no luck. I check the deployment UI and it shows my new client (under Client Tab) as checked in but nothing under Apps.

Another anomaly in this is that we've noticed that it may take hours b/f some servers get the Splunk_TA_nix dir, which is not right of course.

I have the exact steps I use to deploy the linux forwarder if you need to review.

Why is this breaking all of a sudden?
We cannot move ahead w/ 90 more deployments with this current issue. Help is appreciated.
cheers,
Damon

Tags (1)
0 Karma

Pierceyuk
Path Finder

Try a search like "index=_* hostname" it might highlight issues with the connection/host to help troubleshoot

0 Karma

piebob
Splunk Employee
Splunk Employee

i've contacted the Support team, you should receive an email from them shortly.

0 Karma

lukejadamec
Super Champion

Log in to splunk.com, select Support > Support Portal
Or, call your sales rep.

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...