Deployment Architecture

deploymentclient.conf

ArberBabi
New Member

Hi,
In our infrastructure (splunk 6.0.3) we have a deployment server and several indexers. One of my indexers is not showing anymore as a client at Forwarder Managament. I have enabled the deployment client
and the deploymentclient.conf file is as follows
[target-broker:deploymentServer]
targetUri = xxxxxx:8089

[deployment-client]
disabled = false

If I try a tcpdump on port 8089 from the client i can see traffic going through.
Can anyone help on this topic...? Very confusing since all my other clients are showing up correctly

Tags (1)
0 Karma

ArberBabi
New Member

In fact it was a SSL issue, i checked the splunkd log file.

thanks a lot for your help

0 Karma

ArberBabi
New Member

In fact it was a SSL issue, i checked the splunkd log file.

thanks a lot for your help

0 Karma

lguinn2
Legend

Splunk 5 or Splunk 6? If Splunk 6, here are some searches that may help:

1) Is the indexer phoning home to the deployment server? This search lists the phonehomes from deploymentclients; check to see if the indexer appears in this list:

index=_internal phonehome component=DC*  | table _time host log_level message

2) Here is a search to check to see where/when apps are being downloaded:

index=_internal component=DeployedApplication OR component= PackageDownloadRestHandler  sourcetype=splunkd 
| table _time log_level host app message

3) Finally, here is a search that shows how many phonehomes the deployment server is receiving - this isn't monitored by individual clients, but as a summary count...

index=_internal metrics group=deploy-server sourcetype=splunkd 

I often show it as a timechart, like this

index=_internal metrics group=deploy-server sourcetype=splunkd 
| timechart span=2m avg(nReceived) as AvgPhoneHomes by host

Hopefully that will give you some information about what is happening. You might also search the splunkd.log for the indexer and look for any messages related to the deployment server IP address.

0 Karma

ArberBabi
New Member

In fact it was a SSL issue, i checked the splunkd log file.

thanks a lot for your help

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...