Deployment Architecture

deploymentclient.conf

ArberBabi
New Member

Hi,
In our infrastructure (splunk 6.0.3) we have a deployment server and several indexers. One of my indexers is not showing anymore as a client at Forwarder Managament. I have enabled the deployment client
and the deploymentclient.conf file is as follows
[target-broker:deploymentServer]
targetUri = xxxxxx:8089

[deployment-client]
disabled = false

If I try a tcpdump on port 8089 from the client i can see traffic going through.
Can anyone help on this topic...? Very confusing since all my other clients are showing up correctly

Tags (1)
0 Karma

ArberBabi
New Member

In fact it was a SSL issue, i checked the splunkd log file.

thanks a lot for your help

0 Karma

ArberBabi
New Member

In fact it was a SSL issue, i checked the splunkd log file.

thanks a lot for your help

0 Karma

lguinn2
Legend

Splunk 5 or Splunk 6? If Splunk 6, here are some searches that may help:

1) Is the indexer phoning home to the deployment server? This search lists the phonehomes from deploymentclients; check to see if the indexer appears in this list:

index=_internal phonehome component=DC*  | table _time host log_level message

2) Here is a search to check to see where/when apps are being downloaded:

index=_internal component=DeployedApplication OR component= PackageDownloadRestHandler  sourcetype=splunkd 
| table _time log_level host app message

3) Finally, here is a search that shows how many phonehomes the deployment server is receiving - this isn't monitored by individual clients, but as a summary count...

index=_internal metrics group=deploy-server sourcetype=splunkd 

I often show it as a timechart, like this

index=_internal metrics group=deploy-server sourcetype=splunkd 
| timechart span=2m avg(nReceived) as AvgPhoneHomes by host

Hopefully that will give you some information about what is happening. You might also search the splunkd.log for the indexer and look for any messages related to the deployment server IP address.

0 Karma

ArberBabi
New Member

In fact it was a SSL issue, i checked the splunkd log file.

thanks a lot for your help

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...