Newly added forwarder not listing in clients (Forwarder management)

[adminpulse]

Hi Splunk support,

I recently added my second forwarder. Everything was perfectly done. Only one thing is, the newly added forwarder is not listing in client (forwarder management). After restarted also, it remains the same. Screen captures attached herewith. Please give the proper solution on this.

Thanks,

Ragav

[PickleRick]

First and foremost, this is a community forum, not a Splunk support service.

Thank you for recognizing the difference.

[isoutamo]

Hi

have you install / set deployment client configuration (app) to your UF?

r. Ismo

[adminpulse]

Could you please tell the configuration steps

[isoutamo]

I prefer to separate app which have deploymentclient.conf and outputs.conf. Another way is just add deployment server via cli as docs instructed. 1st way give you an option to change those later with DS, 2nd option make this much harder.

[adminpulse]

The architecture i have maintaining is, one receiver (indexer or master) and 2 forwarders (slave). I didn't configure deployment server.

My concern is forwarder 2 should be listed in forwarder management page. That's it

[PickleRick]

1. Master/slave (that's an obsolete terminology, now it's manager/peer) is something used in context of indexer clustering. With indexer and forwarders it's just that - indexer and forwarders.

2. Forwarders only show in Forwarder Management if you register them with the Deployment Server (you have a DS functionality built in your all-in-one instance). It's independent from being the receiver of data forwarded by the forwarders.

3. Forwarders which send events to your indexers show in Monitoring Console.

[isoutamo]

When you are not configuring UF with DS there is no need to use Forwarder Management. Actually your UFs/DCs didn’t exist there unless you haven’t configured those as deployment clients. If you have only some UFs and/or another configuration tool you could use it to deploy UFs’ configurations. 

Based on your explanation, your new forwarder shouldn’t seen there and your situation is ok.

If/when you don’t use DS, you should remove deploymentclient.conf from UFs. That way those don’t make any additional confusion later.