Why deployment apps inputs.conf blacklisted event codes, regex are not reflecting on Splunk agent server ?

[gcusello]

Hi @balu1211,

could you better describe your issue?

is the problem that a configuration file isn't deployed to clients or what else?

Ciao.

Giuseppe

[balu1211]

@gcusello 

Yes the configuration file not deployed to client.

[gcusello]

Hi @balu1211,

there are many possible issues to check:

• are other apps deployed on your client?
  • if yes don't see the following two questions;
• is the client connected to the deployment Server?
  • you can check this viewing in the client list in the DS;
• is the 8089 port between client and DS open?
  • you can check this on client using telent on this port;
• has the user running Splunk on client able to write on the splunk folder?
  • you should check the owner of app on the DS and the the folder and the user running splunk on client;
• is the client in a serverclass using this app?
  • you can cjeck this on DS by GUI i the client list.

Ciao.

Giuseppe