How to manage deployment clients?

[hulahoop]

In Splunk documentation, the communication model between deployment server and clients is described as

The deployment client periodically polls the deployment server, identifying itself.

How often does this polling occur? What if clients fail to check in? How do I identify clients which have not polled the deployment server? Is there an App for this?

[Joffer · Accepted solution]

You can use splunk list deploy-clients to list the clients that have contacted the server.

The phone home interval is 30 seconds by default. It can be changed in $SPLUNK_HOME/etc/system/local/deploymentclient.conf by setting/changing the phoneHomeIntervalInSecs variable. My example below changes this to 1 minute (60 seconds)

#***************************************************************************
# Configure a Splunk deployment client.
# 
# Note: At a minimum the [deployment-client] stanza is required in
# deploymentclient.conf for deployment client to be enabled.
#***************************************************************************
[deployment-client]
disabled = false
serverEndpointPolicy = acceptAlways
phoneHomeIntervalInSecs = 60

#***************************************************************************
# The following stanza specifies deployment server connection information
#***************************************************************************
[target-broker:deploymentServer]
targetUri = splunk01.mydomain.loc:8089

[hulahoop]

Awesome. Thank you, Joffer!