I created a deployment server with 2 forwarders that are sending data to 2 indexers, and they have to be balanced.
I create my apps inside the deploy-server and the apps are correctly sending the data from the forwarders. I added the forwarder at the indexer using the cli, but when I want to select the forwarder using the GUI, I obtain this error:
There are currently no forwarders configured as deployment clients to this instance
I don't really know what to do, because everything seems fine. I used this conf for the output:
Please help me
you need to tell the universal forwarder to poll the deployment server like this:
$SPLUNK_HOME/bin/splunk set deploy-poll <host>:<port>
See Step 2 in the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.3/Forwarding/Deployanixdfmanually#Configuration_step...
Hope that helps ...
I already did this : (
What is reported when you run on the UF:
$SPLUNK_HOME/bin/splunk show deploy-poll
What is reported when you run on the Deployment-server:
$SPLUNK_HOME/bin/splunk list deploy-clients
Can your UF connect to port 8098 of the Deployment-server?
In the end was a so silly mistake! I just called the output -> outputs.
Now I have a new error:
Search peer index1 has the following message: Forwarding to indexer group default-autolb-group blocked for 5400 seconds.
looks like your load some historical data as well and maybe you're pushing too hard for the indexer 😉 either enable
[thruput] maxKBps = <integer>
limits.conf of the UF to limit the amount of events sent or add in the
inputs.conf to your monitor:
ignoreOlderThan = <nonnegative integer>[s|m|h|d]
to ignore historical data.
I tried with both of them but still same problem : (
Check your indexer either with DMC or S.o.S app and see which queue is blocked for what reason.