Deployment Architecture

What timerange does ./splunk list deploy-clients actually report on?

Jason
Motivator

Since I use Deployment Server all the time, and tell all my clients to:

What timerange does ./splunk list deploy-clients actually report on? Is it machines that have checked into the Deployment Server in the past ... 30 seconds? One minute?

Tags (1)
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Actually, in testing, I found that around 2 minutes is the time range.

The results of my command watch -n 15 'date >> /opt/deploy.log && splunk list deploy-clients |grep "IPADDRESS" >> /opt/deploy.log' are found in pastebin below. I stopped the forwarder between the
11:52:55 and 11:53:10 times. I then started the forwarder after the 11:55:57 time. Also, default for phoneHomeIntervalInSecs is 60.

http://pastebin.com/rP2By1FC

UPDATE NOTE: The timeout may be dependent on your system and what configuration options you have set.

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi piebob, I cannot decide it, because there is still no 'real' answer 😉

0 Karma

piebob
Splunk Employee
Splunk Employee

if Jason doesn't decide by the end of today, MuS shall decide!

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Jason, I will do it if you don't want to decide it 😉

Jason
Motivator

bonus! Now I get to decide who is right...

alacercogitatus
SplunkTrust
SplunkTrust

Actually, in testing, I found that around 2 minutes is the time range.

The results of my command watch -n 15 'date >> /opt/deploy.log && splunk list deploy-clients |grep "IPADDRESS" >> /opt/deploy.log' are found in pastebin below. I stopped the forwarder between the
11:52:55 and 11:53:10 times. I then started the forwarder after the 11:55:57 time. Also, default for phoneHomeIntervalInSecs is 60.

http://pastebin.com/rP2By1FC

UPDATE NOTE: The timeout may be dependent on your system and what configuration options you have set.

piebob
Splunk Employee
Splunk Employee

aaand the extra 50 points goes to Alacer!

msettipane
Splunk Employee
Splunk Employee

This has been verified by Splunk. It's every 2 minutes.

0 Karma

Jason
Motivator

From what I understand it's 2 minutes no matter what your phoneHomeInterval is.

0 Karma

Jason
Motivator

Annnd we have a winner. 2mins was verified by dev. Thanks for your testing folks, I've always wondered about this one.

alacercogitatus
SplunkTrust
SplunkTrust

So I reran with phoneHomeInterval = 120. After 2 minutes, the deployment server stopped reporting the client, and within 30 seconds of the drop, it came back after the client phoned home. So I'm thinking 2 minutes is about the timeout.

MuS
SplunkTrust
SplunkTrust

that's a nice one and we already figured that out.

Still the questions remains: what is the exact time range ' ./splunk list deploy-clients' reports on and how could this be changed? If you have phoneHomeIntervallinSecs set to 600 then you will have (with the current setting) clients that never show up...

0 Karma

piebob
Splunk Employee
Splunk Employee

i will award an extra 50 karma points for an accepted* answer to this question.
*(either the original asker accepts, or MuS says it worked 🙂 )

0 Karma

MuS
SplunkTrust
SplunkTrust

bump - would be nice to know what time range is used 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...