Forwarder Management shows 0 agents

[zksvc]

Hi all,

Yesterday I had 8 Universal Forwarders visible in Forwarder Management. Today it shows 0.

Environment

• Splunk Enterprise on Linux acting as a Deployment Server

• Mix of Linux and Windows Universal Forwarders

• Forwarder Management UI has no filters; “All versions” is selected

Questions

1. What are the first checks you recommend when the agent list suddenly drops to zero?

2. Could this be related to license state, SSL on port 8089, or server classes?

3. How can I quickly confirm whether forwarders are still phone-homing to the DS?

4. Which logs or REST endpoints should I look at on the DS and on a UF?

5. Any common misconfigurations that cause this overnight?

Thanks for any guidance and a simple step-by-step to diagnose.

[elend · Accepted solution]

Did you use a custom apps for manage the clients?
i have same simmilar case with this. If there another config file (in my case, there is a restmap config with [broker:broker] stanza).

After i remove this file, and restart the service the deployment server show all the forwarders.

[zksvc]

Hey @elend 

Thankyou for your reply, yes i have restmap.conf too in my custom apps. i got it from template custom apps from my friends, after i comment it all is going good. 

Thanks for help 🤍
Danke

Zake