Deployment Architecture

What is required to use Forwarder Management?

laserval
Communicator

I have a Splunk 6 instance running on Windows. I have no file system access, only access via Splunk Web. The instance was installed using the installer, no extra configuration done.

We have a bunch of forwarders deployed on a set of machines, with all (8089 management and 9997 indexing) ports opened in the firewalls between the Splunk server and these machines.

When I open Forwarder Management, I only get an information text and a "Learn more"-link. No tabs or other parts of the UI are visible.
According to the docs (http://docs.splunk.com/Documentation/Splunk/6.0/Updating/Planadeployment#Configuration_procedure) nothing needs to be configured to use a deployment server - except possibly a directory that might (?) need to be created.

Have I missed something in the configuration of the instance?
Is it necessary to create the deployment app directories to even use the deployment server? From what I can see, there are default values for all deployment server settings (http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Serverclassconf).

1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Have the forwarders been configured to talk to the server? In your deploymentclient.conf on the UF, make sure you have the deployment server config setup. Once you have the forwarder setup, check back in the UI and see if it shows up.

http://docs.splunk.com/Documentation/Splunk/latest/Updating/Configuredeploymentclients

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Have the forwarders been configured to talk to the server? In your deploymentclient.conf on the UF, make sure you have the deployment server config setup. Once you have the forwarder setup, check back in the UI and see if it shows up.

http://docs.splunk.com/Documentation/Splunk/latest/Updating/Configuredeploymentclients

bkcarter
Path Finder

I ran into this today as well. In the old Deployment Server interface I could create new server classes before setting anything up in the file structure. The new Forwarder Management UI has nothing that I could find to get started!

0 Karma

wrangler2x
Motivator

If you create the deployment app directory tree (in $SPLUNK_HOME/etc/deployment-apps on the Deployment Server) and then go into the Forwarder Management UI you will see the deployment app (with the same name as the directory you created in $SPLUNK_HOME/etc/deployment-apps) . Then you can associate it with a server class in the Forwarder Management GUI:

  1. Click on the Apps tab
  2. Click on the app (its name)
  3. Click on the edit button (top, right)
  4. Click the + button (top, left)
  5. Select an existing ServerClass or click on new server class.
0 Karma

laserval
Communicator

This was the problem - or rather, the forwarders had been set up with the wrong configuration. It's now fixed (apparently our Windows instance did not have SSL).

Odd that the forwarder management UI is just empty when there's no clients, though. I would expect it to be possible to create server classes before setting up the clients.
I feel it should be more clearly stated in the docs.

Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...