Deployment Architecture

deployment server clients not showing up

dglass0215
Path Finder

Hello,

When I view the deployment clients under forwarder management, not all my clients are being displayed. Every time I add a client, I can see that the client indeed does download the apps but is not displayed as a client. Currently the deployment server lists 40 clients. And every time I add a client it just stays at 40. Any help is appreciated.

David

0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Can you please confirm whether new universal forwarder has different GUID ? You can find GUID in $SPLUNK_HOME/etc/instance.cfg on Universal Forwarder.

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi dglass0215,
new clients are installed or cloned by another one? if cloned, check hostname in $SPLUNK_HOME/etc/system/local/server.conf and $SPLUNK_HOME/etc/system/local/inputs.conf.

Bye.
Giuseppe

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Can you please confirm whether new universal forwarder has different GUID ? You can find GUID in $SPLUNK_HOME/etc/instance.cfg on Universal Forwarder.

dglass0215
Path Finder

I think this is the problem! Gotta love splunk answers! Faster response then actual support!

However why would I have multiple machines with the same GUID in instance.cfg, and more importantly, What do i do to fix it?

Thanks!

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

If you are cloning machines or splunk forwarder is installed in base image then you'll get same GUID on all new server installation.

To clear GUID on new builds, follow this process https://docs.splunk.com/Documentation/Forwarder/7.3.1/Forwarder/Makeauniversalforwarderpartofahostim...

To create new GUID on existing installation, perform below steps (When you perform below steps, double check hostname in $SPLUNK_HOME/etc/system/local/server.conf and $SPLUNK_HOME/etc/system/local/inputs.conf , if those are not correct then you can change those when you are performing below steps)

  1. Stop Splunk
  2. Remove $SPLUNK_HOME/etc/instance.cfg
  3. Start Splunk (This will create new instance.cfg automatically)
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...