Getting Data In

Why are Linux Forwarders not talking to Deployment Server?

jordanperks
Path Finder

I have a lab setup in VMWare Workstation that has both Linux and Windows servers setup to talk to a Linux deployment server on port 8089 (default). The windows servers are talking to the deployment server, but the linux forwarders (both heavy and universal) are not. Thw windows servers are showing up in settings > forwarder management. Both windows and linux forwarders have the same configuration in deploymentclient.conf:

[target-broker:deploymentServer]
targetUri = 192.168.199.177:8089

I can ping with no problem. I have completely turned off iptables on I have gone through every log file I can find in /opt/splunk/var/log/splunk/* and cannot find any issues. Does anyone know which log I should be looking at to find the issue? I am thinking I may be having a VMWare issue since I have set this up in production many times without issue.

Labels (2)
Tags (2)
1 Solution

jordanperks
Path Finder

Well, I have found the solution. Had to set the hostname in /etc/sysconfig/network and then reboot the server.

View solution in original post

samsplunks
Explorer

If the hostname of your computer is "localhost", it won't even try to connect to the Deployment Server.

0 Karma

jordanperks
Path Finder

Well, I have found the solution. Had to set the hostname in /etc/sysconfig/network and then reboot the server.

muscafe
Explorer

Hello,
i have a similaire problem , what is the hostname to add on /etc/sysconfig/network please?
thank u for your answer

anwarmian
Communicator

Is that a forwarder on the syslog server?

0 Karma

mmukherjee
Explorer

Can you please give a more detailed description of the fix. I think I have the same issue as posted above and I could not find this path "/etc/sysconfig/network".

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Any logs relating to DeploymentClient should be in splunkd.log.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Get Agentic with Splunk Lantern: Connect to Cisco Cloud Control, Transform ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

July Community Events: Master ITSI 5.0 & Automate Splunk

Struggling with alert fatigue or feeling like you're spending more time on infrastructure maintenance than ...

New Release of Federated Search: Bringing Splunk Analytics to More of Your Data

Organizations today are generating more data than ever and storing it across cloud object stores, data lakes, ...