Deployment Architecture

deployment-server socket timeout

tlow
Explorer

Hi version 6.11 , added over 90 hosts in the Forwarder Management in server class.
getting error on the splunk web gui "Gap in numbered regexes: expected attribute=whitelist.82 not found"

i tried reloading the deployment server, and tried to disable it
but getting this error on cmd
opt/splunk/bin/splunk reload deploy-server Socket error communicating with splunkd (error=The read operation timed out), path = /services/deployment/server/config/_reload

seems like to only way is to restart the splunk service?
any work around?

Tags (1)

dmikon
Engager

In my case it was some hidden characters in serverclass.conf, you know copy/paste things... i traced them down and everything tip-top now.

bpwoods
Explorer

Thank you, I will check for that!

0 Karma

jeffrogers
Explorer

I just wasted an appalling amount of time on this problem. I found a row of blanks or characters that can't be seen in vim in an empty row between a comments block and a [serverClass:.....] statement. It was in an area where I had recently pasted a couple dozen rows of text.

We are on 6.1.4. Something is fragile in the deploy-server when it comes to error-handling in the serverclass.conf. It also takes quite a while to restart splunkd when the system is in this state, really slows down troubleshooting.

0 Karma

lguinn2
Legend

"Gap in numbered regexes: expected attribute=whitelist.82 not found"

For this error, check the serverclass.conf file on the deployment server. You should see a number of whitelist entries. They must be in sequential ascending order. My guess is that a line was deleted, leaving a gap. You can fix this manually.

You should reload the deployment server after fixing serverclass.conf using the command

/opt/splunk/bin/splunk reload deploy-server

If that doesn't work, you should try restarting Splunk.

bpwoods
Explorer

Any luck on this? Splunk will not start with my serverclass.conf in place. It becomes completely unresponsive, even after a reboot.

0 Karma

shaikhussain2
Explorer

I am facing the problem in deployment server the thing is i have a path and sourcetype and index i need to do configuration in deployment server already existing app and inputs.conf file is there and serverclass is already setup, so when i configured the new path, sourcetype the data is not reflecting in splunk and also i am not able to see any changes in universal forwarder i tried CLI command also but no changes has shown and my deployment server is windows server.
even same socket error message is showing whenever i reload the DS

0 Karma

dmikon
Engager

Having same error, restarted splunk coupl etimes, checked serverclass.conf, still having same error

0 Karma

lguinn2
Legend

Did you restart Splunk? I suggest that you try that next...

0 Karma

tlow
Explorer

yes, tried to fix the serverclass.conf by removing the error line, and tried /opt/splunk/bin/splunk reload deploy-server, but getting the error..

Socket error communicating with splunkd (error=The read operation timed out), path = /services/deployment/server/config/_reload

is this a bug?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...