Deployment Architecture

The Client forwarder management not showing the clients

AAlhabba
Explorer

Dears,

       After upgraded Splunk from 9.1.2 version to 9.2.0 version, the deployment server not showing the clients, but Splunk receiving logs from clients, and also the client agents showing on all Splunk servers under setting --> Forwarder Managment except Deployment server, I don't know how that occurred, I didn't change anything.

Kindly your support for that.

 

Best Regards, 

1 Solution

AAlhabba
Explorer

Dears,

 

        I have resolved the issue by adding below configuration under outputs.conf in the deployment server, then restart splunk service in the deployment server.

 

[indexAndForward]

index = true

selectiveIndexing = true

 

 

You can see below URL:

 

Upgrade pre-9.2 deployment servers - Splunk Documentation

View solution in original post

landrujw
Explorer

We are experiencing the same thing. The clients are showing up in the client_events logs checking in and phoning home on the deployment server. But after updating to 9.2 they aren't appearing under the Settings>Forwarder Management page on the DS. We have not made any changes to the forwarders yet.

0 Karma

mykol_j
Communicator

FWIW, happening here as well, with 9.2.0.1.

Checked all The Things mentioned in that doc everyone keeps referencing, including those stanzas mentioned numerous times here.

Another symptom of mine is that the ForwarderManager (deployer) doesn't appear in my monitored servers in the SplunkManager (aka Master).

Tags (1)
0 Karma

mykol_j
Communicator

This is nuts. Go figure.

I ended up fixing this my removing the "Deployment Server" role from the system, saving it, then adding it back, restarting the service, bam! Fixed.

I'd rather be lucky than good...

JoshuaJJ
Path Finder

Hmmm, are you talking about the role defined within the Monitoring Console? I am having tons of issues resolving this. 

0 Karma

AAlhabba
Explorer

Hi,

Did you open case with Splunk support about this issue, I already opened still Splunk support trying to resolve it.

 

Best Regards,

0 Karma

ccsfdave
Builder

Any luck with support?  I tried the outputs.conf solution in this thread but it doesn't seem to have worked.  

 

Pre-upgrade from 9.0.x to 9.2.1 I had 300ish clients in my DS.  right now only 14 are showing up.

 

Thanks,

Dave

0 Karma

landrujw
Explorer

Applying the stanza you referenced below worked for us as well:
 

[indexAndForward]
index = true
selectiveIndexing = true   

 Thanks!

computermathguy
Path Finder

Created a local directory within the SplunkDeploymentServerConfig app.  Added the outputs.conf

/opt/splunk/etc/apps/SplunkDeploymentServerConfig/local/outputs.conf

[indexAndForward]
index = true
selectiveIndexing = true



Clients started reporting to the DS after restarting Splunk.  Thankful I found this thread.

0 Karma

R15
Path Finder

Careful, the linked documentation page says not to modify that app in any way.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...