Getting Data In

Universal Forwarder client showing up in wrong server class


Out of our deployement of about 1,000 UF clients, a handful of systems are reporting data to the wrong indexes -- even though they are clearly configured to point to the correct one.

Here's the observations:


Name:    daniels

Green_windows Server Class defined as:

10.14.96.*, 10.14.104.*, 10.14.105.*, 10.14.106.*, 10.14.107.*, 10.14.108.*    <-- note the 108.*

Red_windows server class:

10.14.120.*, 10.14.121.*, 10.14.112.*, 10.14.12.*

BUT, he's showing up with Red's configurations:

    Red_base_config, Red_windows 
Server Classes

But wait, there's more: he's actually sending logs to two indexes: Red_windows AND Orange_windows... (but not Green's)

Sanity check -- the server class for Orange_windows is configured as:

10.14.40.*, 10.14.56.*, 10.14.72.*, 10.14.62.*, 10.14.78.*, 10.14.64.*, 10.14.13.*

We've confirmed the packages being deployed all point to the correct indexes -- and others in the same range are actually working properly!

Client is a Windows 10 system, if that matters...


0 Karma

Splunk Employee
Splunk Employee

Verify you have the correct serverclass defined for this client in the WebGUI "Forwarder Management".

For more details, you can run the following on the deployment server

splunk list deploy-clients > my_dep_clients.txt

And then view that file. It should help breakdown which serverclasses each client belongs to and where the apps are coming from.

Esteemed Legend

You should blacklist that host int the Red and Orange serverclass definitions but I suspect that the real problem is either:
That host is not a Deployment Client of this Deployment Server (should be discernable in the DS GUI).
The Splunk service could not be restarted on that host; manually go there and restart it. If the service does not restart, the configuration changes will not be put into effect.

0 Karma


I think this is the most likely case, Michael.

0 Karma


Note -- looks like my asterisks (*) didn't show up there -- please don't consider that a typo in my config...

0 Karma

Esteemed Legend

I fixed that.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!