Hi version 6.11 , added over 90 hosts in the Forwarder Management in server class.
getting error on the splunk web gui "Gap in numbered regexes: expected attribute=whitelist.82 not found"
i tried reloading the deployment server, and tried to disable it
but getting this error on cmd
opt/splunk/bin/splunk reload deploy-server Socket error communicating with splunkd (error=The read operation timed out), path = /services/deployment/server/config/_reload
seems like to only way is to restart the splunk service?
any work around?
I just wasted an appalling amount of time on this problem. I found a row of blanks or characters that can't be seen in vim in an empty row between a comments block and a [serverClass:.....] statement. It was in an area where I had recently pasted a couple dozen rows of text.
We are on 6.1.4. Something is fragile in the deploy-server when it comes to error-handling in the serverclass.conf. It also takes quite a while to restart splunkd when the system is in this state, really slows down troubleshooting.
"Gap in numbered regexes: expected attribute=whitelist.82 not found"
For this error, check the
serverclass.conf file on the deployment server. You should see a number of whitelist entries. They must be in sequential ascending order. My guess is that a line was deleted, leaving a gap. You can fix this manually.
You should reload the deployment server after fixing
serverclass.conf using the command
/opt/splunk/bin/splunk reload deploy-server
If that doesn't work, you should try restarting Splunk.
I am facing the problem in deployment server the thing is i have a path and sourcetype and index i need to do configuration in deployment server already existing app and inputs.conf file is there and serverclass is already setup, so when i configured the new path, sourcetype the data is not reflecting in splunk and also i am not able to see any changes in universal forwarder i tried CLI command also but no changes has shown and my deployment server is windows server.
even same socket error message is showing whenever i reload the DS
yes, tried to fix the serverclass.conf by removing the error line, and tried /opt/splunk/bin/splunk reload deploy-server, but getting the error..
Socket error communicating with splunkd (error=The read operation timed out), path = /services/deployment/server/config/_reload
is this a bug?