Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Handshake and socket error
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OS for forwarder: Windows Server 2012
Splunk + Universal Forwarder version: 6
I'm trying to get my Universal Forwarder to contact the deployment server. The only "change" I have done during the installation is setting the deployment server in the msiexec.exe.
C:\Program Files\SplunkUniversalForwarder\etc\system\local\deploymentclient.conf:
[target-broker:deploymentServer]
targetUri = server:port
C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log:
10-24-2013 15:46:00.722 +0200 INFO HttpPubSubConnection - Secure HTTP POST failed: Connect to=server:port timed out; exceeded 5sec
10-24-2013 15:46:00.722 +0200 INFO HttpPubSubConnection - Could not obtain connection, will retry after=56 seconds.
10-24-2013 15:46:08.584 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
10-24-2013 15:46:20.597 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
10-24-2013 15:46:32.609 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
10-24-2013 15:46:44.621 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
10-24-2013 15:46:56.634 +0200 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
Log from the Splunk server
10-24-2013 12:33:42.634 +0200 WARN HttpListener - Socket error from X.X.X.X while idling: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request
Just for clearity: I can not see my client trying to phone home in under Forwarder management.
Have I left out something important in my forwarder configuration? Some suggestions on what I'm doing wrong?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well this is embarassing. Turns out I had the wrong url to the deployment server. It's all good now.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Maybe it's a firewall in the route to the deployment server?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Same issue i am facing , and i also checked all urls.
Please help me on this
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well this is embarassing. Turns out I had the wrong url to the deployment server. It's all good now.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
