Getting Data In

Why deployment apps inputs.conf blacklisted event codes, regex are not reflecting on Splunk agent server ?

balu1211
Path Finder
 
Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @balu1211,

could you better describe your issue?

is the problem that a configuration file isn't deployed to clients or what else?

Ciao.

Giuseppe

0 Karma

balu1211
Path Finder

@gcusello 

Yes the configuration file not deployed to client.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @balu1211,

there are many possible issues to check:

  • are other apps deployed on your client?
    • if yes don't see the following two questions;
  • is the client connected to the deployment Server?
    • you can check this viewing in the client list in the DS;
  • is the 8089 port between client and DS open?
    • you can check this on client using telent on this port;
  • has the user running Splunk on client able to write on the splunk folder?
    • you should check the owner of app on the DS and the the folder and the user running splunk on client;
  • is the client in a serverclass using this app?
    • you can cjeck this on DS by GUI i the client list.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...