I added a forwarder on the indexer using the CLI, but why am I getting "There are currently no forwarders configured as deployment clients to this instance"?

[Federica_92]

Hi everyone,

I created a deployment server with 2 forwarders that are sending data to 2 indexers, and they have to be balanced.
I create my apps inside the deploy-server and the apps are correctly sending the data from the forwarders. I added the forwarder at the indexer using the cli, but when I want to select the forwarder using the GUI, I obtain this error:

There are currently no forwarders configured as deployment clients to this instance

I don't really know what to do, because everything seems fine. I used this conf for the output:

[tcpout:my_LB_indexers]
server=10.10.10.1:9997,10.10.10.2:9996,10.10.10.3:9995

Please help me

[MuS]

Hi Federica_92,

you need to tell the universal forwarder to poll the deployment server like this:

$SPLUNK_HOME/bin/splunk set deploy-poll <host>:<port>

See Step 2 in the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.3/Forwarding/Deployanixdfmanually#Configuration_step...

Hope that helps ...

cheers, MuS

[Federica_92]

I tried with both of them but still same problem : (

[MuS]

Check your indexer either with DMC or S.o.S app and see which queue is blocked for what reason.

[Federica_92]

In the end was a so silly mistake! I just called the output -> outputs.
Now I have a new error:
Search peer index1 has the following message: Forwarding to indexer group default-autolb-group blocked for 5400 seconds.

[MuS]

looks like your load some historical data as well and maybe you're pushing too hard for the indexer 😉 either enable

[thruput]
maxKBps = <integer>

in limits.conf of the UF to limit the amount of events sent or add in the inputs.conf to your monitor:

ignoreOlderThan = <nonnegative integer>[s|m|h|d]

to ignore historical data.

[Federica_92]

I already did this : (

[MuS]

What is reported when you run on the UF:

 $SPLUNK_HOME/bin/splunk show deploy-poll

What is reported when you run on the Deployment-server:

 $SPLUNK_HOME/bin/splunk list deploy-clients

Can your UF connect to port 8098 of the Deployment-server?