deploymentclient.conf

[ArberBabi]

Hi,
In our infrastructure (splunk 6.0.3) we have a deployment server and several indexers. One of my indexers is not showing anymore as a client at Forwarder Managament. I have enabled the deployment client
and the deploymentclient.conf file is as follows
[target-broker:deploymentServer]
targetUri = xxxxxx:8089

[deployment-client]
disabled = false

If I try a tcpdump on port 8089 from the client i can see traffic going through.
Can anyone help on this topic...? Very confusing since all my other clients are showing up correctly

[ArberBabi]

In fact it was a SSL issue, i checked the splunkd log file.

thanks a lot for your help

[ArberBabi]

In fact it was a SSL issue, i checked the splunkd log file.

thanks a lot for your help

[lguinn2]

Splunk 5 or Splunk 6? If Splunk 6, here are some searches that may help:

1) Is the indexer phoning home to the deployment server? This search lists the phonehomes from deploymentclients; check to see if the indexer appears in this list:

index=_internal phonehome component=DC*  | table _time host log_level message

2) Here is a search to check to see where/when apps are being downloaded:

index=_internal component=DeployedApplication OR component= PackageDownloadRestHandler  sourcetype=splunkd 
| table _time log_level host app message

3) Finally, here is a search that shows how many phonehomes the deployment server is receiving - this isn't monitored by individual clients, but as a summary count...

index=_internal metrics group=deploy-server sourcetype=splunkd 

I often show it as a timechart, like this

index=_internal metrics group=deploy-server sourcetype=splunkd 
| timechart span=2m avg(nReceived) as AvgPhoneHomes by host

Hopefully that will give you some information about what is happening. You might also search the splunkd.log for the indexer and look for any messages related to the deployment server IP address.

[ArberBabi]

In fact it was a SSL issue, i checked the splunkd log file.

thanks a lot for your help