Deployment Architecture

Need Help With Deployment-Server and Deployment-Client configurations


serverclass.conf in my deployment server running in with the management port 9589

[root@dev etc]# cd system/local/
[root@dev local]# cat serverclass.conf 
stateOnClient = enabled 

i have my testapp in the deployment-apps/testapp/local

this has outputs.conf which will be deployed to the deployment client in with the management port 9689

@client the deploymentclient.conf is located in /system/local/

root@dev local]# cat deploymentclient.conf 
disabled = false
targetUri = 2xx.4xx.1xx.2x1:9589

i got my testapp @cleint /etc/apps/testapp which will forward data to the deployment server on receiving the output.conf form the deployment-app/testapp/local/output.conf

[root@dev local]# cat outputs.conf 
defaultGroup = testf
disabled = false
indexAndForward = true
disabled = false 
server = 2xx.4x.1xx.2x1:9997
forwardedindex.0.whitelist = testindex

i cant find the outputs.conf in the deployment-clients testapp/local/ path.

i have restarted both the splunk instance

i have checked the status of both deployment client and server from CLI. both is enabled.

i checked the splunkd.log

*i can see warn messages as follows in the deployment-server *

04-01-2013 15:11:25.877 +0530 WARN  DeploymentClient - Property targetUri not found. DeploymentClient is disabled.
04-01-2013 15:11:25.877 +0530 INFO  LicenseMgr - Initing LicenseMgr

i can see warn messages as follows in the deployment-client

04-01-2013 14:42:17.315 +0530 WARN  DeploymentClient - Phonehome thread is now started.
04-01-2013 14:42:29.318 +0530 WARN  DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected
04-01-2013 14:42:41.322 +0530 WARN  DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected

please let me know to solve this issue, this is a test i am running before moving to production. i need to solve this issue as early as possible !!!

when i am moving to production i will not only send outputs.conf, i will be sending the all the conf files in the local folder to the deployment client, which will index and forward the indexed data back to the deployment server.

happy splunking,

eashwar raghunathan

0 Karma


Is your deployment client a universal forwarder? If it is, it won't Index and Forward. You need heavy forwarder for that.

Additionally, can you confirm you can connect from client to server? Try: telnet 2xx.4xx.1xx.2x1 9589 from the client and make sure it connects successfully.


thanks brother!!! i will reply back if i got any problem after getting things done above!!

0 Karma


You will need to check with your Network/Firewall guy to make sure ACLs, ports, etc are all open on 9589 and 9997 between client and server. Once you get the telnet command to work, deployment server should work as well.

0 Karma


[root@dev bin]# telnet 2xx.4x.1x.2x1 9589
Trying 2xx.4x.1x.2x1..
telnet: connect to address 2xx.4x.1x.2x1: Connection timed out
telnet: Unable to connect to remote host: Connection timed out

thanks brother,
can you please tell me how should i solve this issue.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!