Heavy Forwarder not showing in Deployment Server

[ashish9433]

Hi Team,

I am facing a very strange issue.

I have two heavy forwarder, let say host1 and host2. I am getting data from both host1 and host2 on Indexer's but when only either of them get listed on deployment server at a time.

If I restart host1, deployment server will list host1, as soon as I go ahead and restart host2, host1 gets de-listed and host2 starts showing up. So at any point of time I am unable to get both listed together.

PS : - what has happened earlier was in inputs.conf file of host2 below was by mistake done and later it was fixed but the problem is not fixed.

inputs.conf of host2
[default]
host=host1

Since in host2, the host=host1 was configured, we realized later and fixed it but both the forwarders are not getting listed together on deployment server since then.

Any help? how to troubleshoot this issue.

[s2_splunk · Accepted solution]

Have you restarted your deployment server since making the change to inputs.conf on the deployment client?

Did you clone your HF installs or were they installed by running the installation scripts individually? If you cloned, take a look at $SPLUNK_HOME/etc/instance.cfg and you'll probably see that both HFs are using the same guid. Delete the file on one of them and restart the HWF, it will generate a new guid. Not 100% sure this causes the behavior you are observing, but risk-free to try.

[ashish9433]

Thanks a lot @ssievert, it really worked! That was the issue

[s2_splunk]

Which one? restart or duplicate GUID?
I am converting my comment to an answer; please accept it to preserve for posterity. Thanks!

[ashish9433]

duplicate GUID was the issue & deleting the instance.cfg and restarting the service fixed the issue.