Deployment Architecture

What is required to use Forwarder Management?

laserval
Communicator

I have a Splunk 6 instance running on Windows. I have no file system access, only access via Splunk Web. The instance was installed using the installer, no extra configuration done.

We have a bunch of forwarders deployed on a set of machines, with all (8089 management and 9997 indexing) ports opened in the firewalls between the Splunk server and these machines.

When I open Forwarder Management, I only get an information text and a "Learn more"-link. No tabs or other parts of the UI are visible.
According to the docs (http://docs.splunk.com/Documentation/Splunk/6.0/Updating/Planadeployment#Configuration_procedure) nothing needs to be configured to use a deployment server - except possibly a directory that might (?) need to be created.

Have I missed something in the configuration of the instance?
Is it necessary to create the deployment app directories to even use the deployment server? From what I can see, there are default values for all deployment server settings (http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Serverclassconf).

1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Have the forwarders been configured to talk to the server? In your deploymentclient.conf on the UF, make sure you have the deployment server config setup. Once you have the forwarder setup, check back in the UI and see if it shows up.

http://docs.splunk.com/Documentation/Splunk/latest/Updating/Configuredeploymentclients

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Have the forwarders been configured to talk to the server? In your deploymentclient.conf on the UF, make sure you have the deployment server config setup. Once you have the forwarder setup, check back in the UI and see if it shows up.

http://docs.splunk.com/Documentation/Splunk/latest/Updating/Configuredeploymentclients

bkcarter
Path Finder

I ran into this today as well. In the old Deployment Server interface I could create new server classes before setting anything up in the file structure. The new Forwarder Management UI has nothing that I could find to get started!

0 Karma

wrangler2x
Motivator

If you create the deployment app directory tree (in $SPLUNK_HOME/etc/deployment-apps on the Deployment Server) and then go into the Forwarder Management UI you will see the deployment app (with the same name as the directory you created in $SPLUNK_HOME/etc/deployment-apps) . Then you can associate it with a server class in the Forwarder Management GUI:

  1. Click on the Apps tab
  2. Click on the app (its name)
  3. Click on the edit button (top, right)
  4. Click the + button (top, left)
  5. Select an existing ServerClass or click on new server class.
0 Karma

laserval
Communicator

This was the problem - or rather, the forwarders had been set up with the wrong configuration. It's now fixed (apparently our Windows instance did not have SSL).

Odd that the forwarder management UI is just empty when there's no clients, though. I would expect it to be possible to create server classes before setting up the clients.
I feel it should be more clearly stated in the docs.

Thanks for the help!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...