UF details not reflecting in deployment server

[abhi]

Hello Team,

I am configuring Splunk, but the UF (Universal Forwarder) details are not reflecting in the Deployment Server's client list. I have added the following stanza in the UF's `deploymentclient.conf` file:

```
[deployment-client]
clientName = UF
phoneHomeIntervalInSecs = 60

[target-broker:deploy]
targetUri = 10.128.0.5:8089
```

(10.128.0.5 is the IP of the Deployment Server)

And in the Deployment Server's `server.conf`, the following details are present:

```
[general]
serverName = deploy
pass4SymmKey = $7$k63bewtZlaVREpHJcD6fGt6hysZ/GvxJ0Tfq0BW5PhmF/qItBTzTA==

[sslConfig]
sslPassword = $7$boaNPEqR2Gmt9DQPKp9ZJ0iho9HdJFoRuxVZMwBu/q8g/v9ZKzsEvw==
enableSplunkdSSL = false

[lmpool:auto_generated_pool_download-trial]
description = auto_generated_pool_download-trial
peers = *
quota = MAX
stack_id = download-trial

[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
peers = *
quota = MAX
stack_id = forwarder

[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
peers = *
quota = MAX
stack_id = free

[deploymentServer]
disabled = false
```

And in the `serverclass.conf`, I have added the following details:

```
[global]
[serverClass:uf_class]
whitelist.0 = uf
[serverClass:uf_class:app:forwarder_app]
```

Even after adding these details, the issue persists. Please suggest some solutions.

[isoutamo]

After 9.2 the reason for this is that DS needs local indexes for get information about DCs.  And best practices said that you should forward all logs into your indexer instead of keeping those into local node like DS. You could fix this by adding to stored those indexes also into locally. 

https://docs.splunk.com/Documentation/Splunk/9.2.0/Updating/Upgradepre-9.2deploymentservers here is instructions how to do it.

[kiran_panchavat]

@abhi 

Edit deploymentclient.conf

[deployment-client]
[target-broker:deploymentServer]
targetUri= https://10.128.0.5:8089

NOTE: You can run the below commands directly on the UF and it will create the deploymentclient.conf

/opt/splunk/bin/splunk set deploy-poll <IP_address/hostname>:<management_port>
/opt/splunk/bin/splunk restart

Refer:

https://docs.splunk.com/Documentation/Splunk/9.4.2/Updating/Configuredeploymentclients#Use_the_CLI 

You could always look in forwarder management on the deployment server, or use this REST command on the Deployment server: 

| rest splunk_server=local /services/deployment/server/clients

Try run this command to check the clients:

/opt/splunk/bin/splunk list deploy-clients -auth <username>:<password>

If your DS is 9.2.x, read this https://community.splunk.com/t5/Deployment-Architecture/The-Client-forwarder-management-not-showing-... 

[livehybrid]

Hi @abhi 

Your deploymentclient.conf stanza is incorrect, it must be "target-broker:deploymentServer" as below:

[target-broker:deploymentServer]
targetUri= <string>
* The target URI of the deployment server.
* An example of <uri>: <scheme>://<deploymentServer>:<mgmtPort>

For more details check out the deploymentclient.conf docs at https://docs.splunk.com/Documentation/Splunk/9.4.2/Admin/Deploymentclientconf#:~:text=%5Btarget%2Dbr...

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[PaulPanther]

So the UF is not phoning home  successfully and not popping up in the Clients tab on the DeploymentServer?

Change your deploymentclient.conf on your UF stanza as below:

[target-broker:deploymentServer]
targetUri = https://10.128.0.5:8089