Getting Data In

Brand new Deployment client will not connect. 401 errors in splunkd_access logs on DS

jeremyhagand61
Communicator

I'm having trouble getting a new deployment client to connect to the DS. I can see connectivity is established, but the client keeps logging an error:

 

 

DC:DeploymentClient ... channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected

 

 

 

Looking at the splunkd_access log on the DS I can see the handshake message being recieved with a 401 by the DS

 

 

10.X.X.2 - - ... "POST /services/broker/connect/GUID/CLIENTNAME/guff/linux-x86_64/8089/9.0.2/GUID/universale_forwarder/CLIENTNAME HTTP/1.1" 401

 

 

I have plenty of Windows machines in the environment connecting successfully to this DS (also running on Windows). But this server and a few other Linux machines are not connecting.

Any advice?

 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hİ @jeremyhagand61,

It seems pass4SymmKey is set on your deployment server. Please try adding pass4SymmKey like below server.conf setting on your deployment clients.

server.conf

[deployment]
pass4SymmKey = yourpasssymkey

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hİ @jeremyhagand61,

It seems pass4SymmKey is set on your deployment server. Please try adding pass4SymmKey like below server.conf setting on your deployment clients.

server.conf

[deployment]
pass4SymmKey = yourpasssymkey

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

jeremyhagand61
Communicator

That was it. Someone had been fiddling as it wasn't meant to be enabled. I learned something new about DS auth. I have disabled it on the DS side.

Thanks for the quick response.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...