Getting Data In

Heavy Forwarder not showing in Deployment Server

ashish9433
Communicator

Hi Team,

I am facing a very strange issue.

I have two heavy forwarder, let say host1 and host2. I am getting data from both host1 and host2 on Indexer's but when only either of them get listed on deployment server at a time.

If I restart host1, deployment server will list host1, as soon as I go ahead and restart host2, host1 gets de-listed and host2 starts showing up. So at any point of time I am unable to get both listed together.

PS : - what has happened earlier was in inputs.conf file of host2 below was by mistake done and later it was fixed but the problem is not fixed.

inputs.conf of host2
[default]
host=host1

Since in host2, the host=host1 was configured, we realized later and fixed it but both the forwarders are not getting listed together on deployment server since then.

Any help? how to troubleshoot this issue.

1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Have you restarted your deployment server since making the change to inputs.conf on the deployment client?

Did you clone your HF installs or were they installed by running the installation scripts individually? If you cloned, take a look at $SPLUNK_HOME/etc/instance.cfg and you'll probably see that both HFs are using the same guid. Delete the file on one of them and restart the HWF, it will generate a new guid. Not 100% sure this causes the behavior you are observing, but risk-free to try.

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

Have you restarted your deployment server since making the change to inputs.conf on the deployment client?

Did you clone your HF installs or were they installed by running the installation scripts individually? If you cloned, take a look at $SPLUNK_HOME/etc/instance.cfg and you'll probably see that both HFs are using the same guid. Delete the file on one of them and restart the HWF, it will generate a new guid. Not 100% sure this causes the behavior you are observing, but risk-free to try.

ashish9433
Communicator

Thanks a lot @ssievert, it really worked! That was the issue

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Which one? restart or duplicate GUID?
I am converting my comment to an answer; please accept it to preserve for posterity. Thanks!

0 Karma

ashish9433
Communicator

duplicate GUID was the issue & deleting the instance.cfg and restarting the service fixed the issue.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...