Getting Data In

Use one forwarder to act as deployment manager to other forwarders



I have a couple of heavy forwarders to monitor a particular platform, each one for a specific context (dev / test / prod). there is a central indexer with a working deployment manager where, for various reasons, I prefer not to put the config I want to be deploying to my above-mentioned forwarders.

This appears to be a problem in the forwarder management setup on my "main" forwarder as the host names of the "other" forwarders do not appear to be recognized. I can't find anything in the docs that would hint at a restriction, but I can't find either where to define my "other" forwarders as clients to the "main" one. I can see serverclass.conf has been added after I saved the "Edit Clients" page, I also tried bouncing the forwarder but no list of possible client hosts are coming up.

What am I missing pls?

Thanks Vincent.

Tags (2)
0 Karma


Sorted - I missed the bit documented here:

the "phoning" has to be enabled on the "other" forwarders.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!