Deployment Architecture

Why is deployment client not showing up on the deployment console?

smcdonald20
Path Finder

I am having an issue where some of my deployment clients are not showing up under the clients tab on the forwarder management console.

I have checked the below:
Telnet to deployment server on 8089 successfully - Yes
deploymentclient.conf targetUri set correctly - Yes ( hostname.options-it.com:8089)

Is there anything else I should be checking?
From reading online I tried to do the command Splunk show deploy-poll but got an error "Authentication needed, run "splunk login" but cannot run "splunk login" from the bin folder. Is this a clue of something wrong?

Thanks

0 Karma
1 Solution

smcdonald20
Path Finder

After looking at Diag, I found out that the GUID for the deployment Client seem to be the same on several machines .

you can see the same doing the following search : index=_internal "changed some of its properties on the latest phone home" |stats values(ip) values(hostname)
from your DMC or the deployment server ,
you will get a list of all the hostnames and IP that are generating the error , see attached CSV file .

As a solution you can delete the the GUID is in $SPLUNK_HOME/etc/instance.cfg and restart splunk after that ,

for future reference assuming you are cloning client OS , you should follow this documentation :
http://docs.splunk.com/Documentation/Forwarder/7.0.3/Forwarder/Makeauniversalforwarderpartofahostima...

View solution in original post

smcdonald20
Path Finder

After looking at Diag, I found out that the GUID for the deployment Client seem to be the same on several machines .

you can see the same doing the following search : index=_internal "changed some of its properties on the latest phone home" |stats values(ip) values(hostname)
from your DMC or the deployment server ,
you will get a list of all the hostnames and IP that are generating the error , see attached CSV file .

As a solution you can delete the the GUID is in $SPLUNK_HOME/etc/instance.cfg and restart splunk after that ,

for future reference assuming you are cloning client OS , you should follow this documentation :
http://docs.splunk.com/Documentation/Forwarder/7.0.3/Forwarder/Makeauniversalforwarderpartofahostima...

p_gurav
Champion

Can you try running :

splunk show deploy-poll -auth admin:changeme
0 Karma

smcdonald20
Path Finder

Thanks! This works, but it brings me back the expected deployment server opspkdply:8089.
Any other ideas of why the client isn't showing up on the deployment server?

0 Karma

p_gurav
Champion

Can you checked in _internal logs for forwarder? Is there any error?

0 Karma

smcdonald20
Path Finder

In Splunkd logs i do see the following error:
DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
DS_DC_Common - Deployment Client initialized.
ServerRoles - Declared role=deployment_client.
DS_DC_Common - Deployment Server not available on a dedicated forwarder.

@p_gurav do any of the above mean anything to you?

0 Karma

p_gurav
Champion

Did you restart forwarder after setting deploy-poll? Also can you share deploymentclient.conf file ?

0 Karma

smcdonald20
Path Finder

I didn't actually make any changes. I ran splunk show deploy-poll.
After seeing this comment, i ran splunk set deploy-poll but it showed "no configuration changes made".

I have restarted the forwarder regardless, do i also need to restart Splunk on the deployment server?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...