Deployment Architecture

Why do forwarders not show up in forwarder management?

Path Finder

i installed a new splunk enterprise server and configured it as deploy server as documented here:
then i added an app in $SPLUNK_HOME/etc/deployment-apps/MyApp
on the 26 forwarders running ubuntu 20.04 i ran splunk set deploy-poll MyDS:8089 but only 20 of them show up in the forwarder management.
when i remove one of them by clicking on "delete record", i can add a missing one by running splunk set deploy-poll MyDS:8089 again.
a license is installed too and it says  'DeployServer': 'ENABLED'

any ideas?

Labels (1)
0 Karma

Path Finder

found the stupid mistake

the not showing forwarders where restarted and splunkd wasn't configured to start on boot 😞

unfortunately 'splunk set deploy-poll MyDS:8089' does not complain about not running splunkd.
anyway, changed config and all forwarders show up...

next issue probably coming soon 😉


Check if there is no connection issues from the missing UFs
You can use open ssl in CLI to test this from each UF host.

openssl s_client -connect MyDS:8089 

If everything is fine you should see the details on the cert of your DS. If not, you might have something blocking the connection

Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

Path Finder

that's not the problem.

connection works from all clients...

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...