Deployment Architecture

Newly added forwarder not listing in clients (Forwarder management)

adminpulse
Loves-to-Learn Lots

Hi Splunk support,

I recently added my second forwarder. Everything was perfectly done. Only one thing is, the newly added forwarder is not listing in client (forwarder management). After restarted also, it remains the same. Screen captures attached herewith. Please give the proper solution on this.

Thanks,

Ragav

Active forward.pngForwarder not listing.pngListing in Host.png

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

First and foremost, this is a community forum, not a Splunk support service.

Thank you for recognizing the difference.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you install / set deployment client configuration (app) to your UF?

r. Ismo

0 Karma

adminpulse
Loves-to-Learn Lots

Could you please tell the configuration steps

0 Karma

isoutamo
SplunkTrust
SplunkTrust

I prefer to separate app which have deploymentclient.conf and outputs.conf. Another way is just add deployment server via cli as docs instructed. 1st way give you an option to change those later with DS, 2nd option make this much harder.

0 Karma

adminpulse
Loves-to-Learn Lots

The architecture i have maintaining is, one receiver (indexer or master) and 2 forwarders (slave). I didn't configure deployment server.

My concern is forwarder 2 should be listed in forwarder management page. That's it

0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. Master/slave (that's an obsolete terminology, now it's manager/peer) is something used in context of indexer clustering. With indexer and forwarders it's just that - indexer and forwarders.

2. Forwarders only show in Forwarder Management if you register them with the Deployment Server (you have a DS functionality built in your all-in-one instance). It's independent from being the receiver of data forwarded by the forwarders.

3. Forwarders which send events to your indexers show in Monitoring Console.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

When you are not configuring UF with DS there is no need to use Forwarder Management. Actually your UFs/DCs didn’t exist there unless you haven’t configured those as deployment clients. If you have only some UFs and/or another configuration tool you could use it to deploy UFs’ configurations. 

Based on your explanation, your new forwarder shouldn’t seen there and your situation is ok.

If/when you don’t use DS, you should remove deploymentclient.conf from UFs. That way those don’t make any additional confusion later.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...