Getting Data In

Can I make the deployment server also be the deployment client?

domino30
Explorer

So scenario is a vm that can ping another vm.

1st vm is linux rhel : I installed splunk enterprise and made it the deployment server 

also yes I enabled receiving on 9997

2nd vm is a win 10 64 bit: Installed universal forwarder and did the customize option and put in IP of linux box for receiver and for deployment server.

when I got to add data I get this error:  There are currently no forwarders configured as deployment clients to this instance. Learn More 

I tried making the deployment server also be the deployment client but according to my reading you can't do that is this right?

do I need a third box and make it either my deployment server or deployment client?

 

Labels (3)
0 Karma

gcusello
Esteemed Legend

HI @domino30,

as @isoutamo said, at first check the connectivity between the machines using telnet from the Forwarder both on 9997 and 8089 ports.

Then, could you share you outputs.conf and deploymentclient.conf from your Forwarder?

Did you disabled local Forwarder on the Linux Machine?

Ciao.

Giuseppe

0 Karma

domino30
Explorer

Did you disabled local Forwarder on the Linux Machine? would I need to?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

this should work.  I suppose that you have followed these instructions https://docs.splunk.com/Documentation/Splunk/9.0.1/Updating/Planadeployment ?

Have you already added any apps to DS for deployment?

One thing which you should check that there is no host based firewall on those nodes (especially on DS) which prevents the access. You could use just 

telnet <ip of ds server> 8089

to check this. If you haven’t telnet on Windows then you could use e.g. powershell to emulate the same functionality. You should look exact command/script from google.

r. Ismo 

0 Karma

domino30
Explorer

so telenet from windows box to linux box if I can do this then i've checked that firewalls aren't the issue?

 

 

I think I might have my ips off.

0 Karma

domino30
Explorer

alright get ready so if the IP of my computer is 10.0.2.3

and the nslookup is 10.1.2.19  or something like that  which one am I using and the IP for Deployment server

I realize this might be a bad question but thats where I am at.

this is A or B.PNG

I know I did one thing right I got the default ports right

so far.PNG

this is what I got for forwarder mostly because I was trying all sorts of things to get it to work

0 Karma

gcusello
Esteemed Legend

Hi @domino30,

why are you using 8089 port to forward data?

this is a management port and cannot be used for data, probably this is the misconfiguration.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...