proper location for phoneHomeIntervalInSecs

[vhaisddellaj]

We are just now beginning to deploy the splunkforwarder for linux in our Large organization

We are running the agent as s systemd service

the file  /opt/splunkforwarder/etc/apps/<redacted>/local/deploymentclient.conf

has these settings

[deployment-client]
clientName =<redacted>

[target-broker:depolymentServer]
targetUri = splunkuf-<redacted>:8089
#
# The splunk UF will phone home every 14400 sec = 4hrs
# 300sec=5min 900sec=15min
phoneHomeIntervalInSecs = 900

On RedHat 8 .4 systems there are no issues when I run systemctl status SplunkForwarder -l

but on RedHat 7.9 i get the following

Splunk> Australian for grep.
Checking prerequisites...
Management port has been set disabled; cli support for this configuration is currently incomplete.
Invalid key in stanza [target-broker:depolymentServer] in /opt/splunkforwarder/etc/apps/<redacted>local/deploymentclient.conf, line 12: phoneHomeIntervalInSecs (value: 900).

Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'
Checking conf files for problems...
Done
Checking default conf files for edits...

if I move the  phoneHomeIntervalInSecs  entry to under the [deployment-client] I don't get the error

[deployment-client]
clientName =<redacted>

phoneHomeIntervalInSecs = 900

[target-broker:depolymentServer]
targetUri = splunkuf-<redacted>:8089
#
# The splunk UF will phone home every 14400 sec = 4hrs
# 300sec=5min 900sec=15min
# phoneHomeIntervalInSecs = 900

Please advise on the correct location for this setting

Thanks

[ldongradi_SPL]

Just to be sure ... you would have noticed the typo in stanza [target-broker:deploymentServer] that you wrote [target-broker:depolymentServer] instead ?

If the typo exist and exactly the same on both OS, consider it is being ignored on RedHat 8.4 for some reason, while RedHad 7.9 does not accept the error.

Anyway, as mentioned the correct location for  phoneHomeIntervalInSecs is in [deployment-client].

[vhaisddellaj]

Thanks

I will notify the splunk admin who deploys the apps to make the corrections for both RHEL 8 and RHEL 7 and to also fix the typo in the stanza

thanks

[richgalloway]

According to the Admin manual, the phoneHomeIntervalInSecs setting goes in the [deployment-client] stanza.