Deployment Architecture

What timerange does ./splunk list deploy-clients actually report on?

Motivator

Since I use Deployment Server all the time, and tell all my clients to:

What timerange does ./splunk list deploy-clients actually report on? Is it machines that have checked into the Deployment Server in the past ... 30 seconds? One minute?

Tags (1)
1 Solution

SplunkTrust
SplunkTrust

Actually, in testing, I found that around 2 minutes is the time range.

The results of my command watch -n 15 'date >> /opt/deploy.log && splunk list deploy-clients |grep "IPADDRESS" >> /opt/deploy.log' are found in pastebin below. I stopped the forwarder between the
11:52:55 and 11:53:10 times. I then started the forwarder after the 11:55:57 time. Also, default for phoneHomeIntervalInSecs is 60.

http://pastebin.com/rP2By1FC

UPDATE NOTE: The timeout may be dependent on your system and what configuration options you have set.

View solution in original post

SplunkTrust
SplunkTrust

Hi piebob, I cannot decide it, because there is still no 'real' answer 😉

0 Karma

Motivator

if Jason doesn't decide by the end of today, MuS shall decide!

0 Karma

SplunkTrust
SplunkTrust

Hi Jason, I will do it if you don't want to decide it 😉

Motivator

bonus! Now I get to decide who is right...

SplunkTrust
SplunkTrust

Actually, in testing, I found that around 2 minutes is the time range.

The results of my command watch -n 15 'date >> /opt/deploy.log && splunk list deploy-clients |grep "IPADDRESS" >> /opt/deploy.log' are found in pastebin below. I stopped the forwarder between the
11:52:55 and 11:53:10 times. I then started the forwarder after the 11:55:57 time. Also, default for phoneHomeIntervalInSecs is 60.

http://pastebin.com/rP2By1FC

UPDATE NOTE: The timeout may be dependent on your system and what configuration options you have set.

View solution in original post

Motivator

aaand the extra 50 points goes to Alacer!

Splunk Employee
Splunk Employee

This has been verified by Splunk. It's every 2 minutes.

0 Karma

Motivator

From what I understand it's 2 minutes no matter what your phoneHomeInterval is.

0 Karma

Motivator

Annnd we have a winner. 2mins was verified by dev. Thanks for your testing folks, I've always wondered about this one.

SplunkTrust
SplunkTrust

So I reran with phoneHomeInterval = 120. After 2 minutes, the deployment server stopped reporting the client, and within 30 seconds of the drop, it came back after the client phoned home. So I'm thinking 2 minutes is about the timeout.

SplunkTrust
SplunkTrust

that's a nice one and we already figured that out.

Still the questions remains: what is the exact time range ' ./splunk list deploy-clients' reports on and how could this be changed? If you have phoneHomeIntervallinSecs set to 600 then you will have (with the current setting) clients that never show up...

0 Karma

Motivator

i will award an extra 50 karma points for an accepted* answer to this question.
*(either the original asker accepts, or MuS says it worked 🙂 )

0 Karma

SplunkTrust
SplunkTrust

bump - would be nice to know what time range is used 😉

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!