Getting Data In

Brand new Deployment client will not connect. 401 errors in splunkd_access logs on DS

jeremyhagand61
Communicator

I'm having trouble getting a new deployment client to connect to the DS. I can see connectivity is established, but the client keeps logging an error:

 

 

DC:DeploymentClient ... channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected

 

 

 

Looking at the splunkd_access log on the DS I can see the handshake message being recieved with a 401 by the DS

 

 

10.X.X.2 - - ... "POST /services/broker/connect/GUID/CLIENTNAME/guff/linux-x86_64/8089/9.0.2/GUID/universale_forwarder/CLIENTNAME HTTP/1.1" 401

 

 

I have plenty of Windows machines in the environment connecting successfully to this DS (also running on Windows). But this server and a few other Linux machines are not connecting.

Any advice?

 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hİ @jeremyhagand61,

It seems pass4SymmKey is set on your deployment server. Please try adding pass4SymmKey like below server.conf setting on your deployment clients.

server.conf

[deployment]
pass4SymmKey = yourpasssymkey

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hİ @jeremyhagand61,

It seems pass4SymmKey is set on your deployment server. Please try adding pass4SymmKey like below server.conf setting on your deployment clients.

server.conf

[deployment]
pass4SymmKey = yourpasssymkey

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

jeremyhagand61
Communicator

That was it. Someone had been fiddling as it wasn't meant to be enabled. I learned something new about DS auth. I have disabled it on the DS side.

Thanks for the quick response.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...