Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: I added a forwarder on the indexer using the C...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I added a forwarder on the indexer using the CLI, but why am I getting "There are currently no forwarders configured as deployment clients to this instance"?
Hi everyone,
I created a deployment server with 2 forwarders that are sending data to 2 indexers, and they have to be balanced.
I create my apps inside the deploy-server and the apps are correctly sending the data from the forwarders. I added the forwarder at the indexer using the cli, but when I want to select the forwarder using the GUI, I obtain this error:
There are currently no forwarders configured as deployment clients to this instance
I don't really know what to do, because everything seems fine. I used this conf for the output:
[tcpout:my_LB_indexers]
server=10.10.10.1:9997,10.10.10.2:9996,10.10.10.3:9995
Please help me
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Federica_92,
you need to tell the universal forwarder to poll the deployment server like this:
$SPLUNK_HOME/bin/splunk set deploy-poll <host>:<port>
See Step 2 in the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.3/Forwarding/Deployanixdfmanually#Configuration_step...
Hope that helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tried with both of them but still same problem : (
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check your indexer either with DMC or S.o.S app and see which queue is blocked for what reason.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In the end was a so silly mistake! I just called the output -> outputs.
Now I have a new error:
Search peer index1 has the following message: Forwarding to indexer group default-autolb-group blocked for 5400 seconds.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
looks like your load some historical data as well and maybe you're pushing too hard for the indexer 😉 either enable
[thruput]
maxKBps = <integer>
in limits.conf of the UF to limit the amount of events sent or add in the inputs.conf to your monitor:
ignoreOlderThan = <nonnegative integer>[s|m|h|d]
to ignore historical data.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I already did this : (
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is reported when you run on the UF:
$SPLUNK_HOME/bin/splunk show deploy-poll
What is reported when you run on the Deployment-server:
$SPLUNK_HOME/bin/splunk list deploy-clients
Can your UF connect to port 8098 of the Deployment-server?
Tech Talk Recap | Mastering Threat Hunting
Observability for AI Applications: Troubleshooting Latency
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
