deployment-server socket timeout

[tlow]

Hi version 6.11 , added over 90 hosts in the Forwarder Management in server class.
getting error on the splunk web gui "Gap in numbered regexes: expected attribute=whitelist.82 not found"

i tried reloading the deployment server, and tried to disable it
but getting this error on cmd
opt/splunk/bin/splunk reload deploy-server Socket error communicating with splunkd (error=The read operation timed out), path = /services/deployment/server/config/_reload

seems like to only way is to restart the splunk service?
any work around?

[dmikon]

In my case it was some hidden characters in serverclass.conf, you know copy/paste things... i traced them down and everything tip-top now.

[bpwoods]

Thank you, I will check for that!

[jeffrogers]

I just wasted an appalling amount of time on this problem. I found a row of blanks or characters that can't be seen in vim in an empty row between a comments block and a [serverClass:.....] statement. It was in an area where I had recently pasted a couple dozen rows of text.

We are on 6.1.4. Something is fragile in the deploy-server when it comes to error-handling in the serverclass.conf. It also takes quite a while to restart splunkd when the system is in this state, really slows down troubleshooting.

[lguinn2]

"Gap in numbered regexes: expected attribute=whitelist.82 not found"

For this error, check the serverclass.conf file on the deployment server. You should see a number of whitelist entries. They must be in sequential ascending order. My guess is that a line was deleted, leaving a gap. You can fix this manually.

You should reload the deployment server after fixing serverclass.conf using the command

/opt/splunk/bin/splunk reload deploy-server

If that doesn't work, you should try restarting Splunk.

[bpwoods]

Any luck on this? Splunk will not start with my serverclass.conf in place. It becomes completely unresponsive, even after a reboot.

[shaikhussain2]

I am facing the problem in deployment server the thing is i have a path and sourcetype and index i need to do configuration in deployment server already existing app and inputs.conf file is there and serverclass is already setup, so when i configured the new path, sourcetype the data is not reflecting in splunk and also i am not able to see any changes in universal forwarder i tried CLI command also but no changes has shown and my deployment server is windows server.
even same socket error message is showing whenever i reload the DS

[dmikon]

Having same error, restarted splunk coupl etimes, checked serverclass.conf, still having same error

[lguinn2]

Did you restart Splunk? I suggest that you try that next...

[tlow]

yes, tried to fix the serverclass.conf by removing the error line, and tried /opt/splunk/bin/splunk reload deploy-server, but getting the error..

Socket error communicating with splunkd (error=The read operation timed out), path = /services/deployment/server/config/_reload

is this a bug?