Why does my distributed management console show 0 deployment clients?

[abhayneilam]

Hi,

I have configured my universal forwarder as a deployment client and my search head as a " deployment server"

but still when I go to the forward management console of Search Head, I could see 1 application, 1 server class, but 0 deployment client

and beside that, it is showing "DEPLOYMENT ERRORS" .

could you please let me know how to solve this problem ?

Note : I have verified my deployment client is connecting to the right deployment server ( ./splunk show deploy-poll ) . I am not able to understand , even after doing every thing correct why it is showing like "DEPLOYMENT ERRORS" . I have SearchHead and UF in oracle VM.

[woodcock]

First of all, your "deployment errors" aren't related to your problem so forget them. Given everything you have clarified I suspect that the "problem" is not really a problem: I assume that Splunk does not populate the deployment client field unless an app has actually been deployed. To test this presumption and confirm whether you really have a problem, try deploying an app to that DC and see if it gets deployed and if the deployment client field increases by 1.

[woodcock]

If indeed your DS is at IP address 192.168.56.111 then the problem must be you have firewall blocking or lack of route. To test both do this on your forwarder from CLI:

telnet 192.168.56.111 8089

If you get timeout, it is the firewall; if you get no route to host, it is missing route.

[abhayneilam]

[root@localhost local]# telnet 192.168.56.111 8089
Trying 192.168.56.111...
Connected to 192.168.56.111.
Escape character is '^]'.

I am able to connect to my DS from UF

[woodcock]

That is all there is to it unless Splunk client is not running:

$SPLUNK_HOME/bin/splunk status

[abhayneilam]

[root@localhost local]# /opt/splunkforwarder/bin/splunk status
splunkd is running (PID: 6963).
splunk helpers are running (PIDs: 6964).
[root@localhost local]#

[abhayneilam]

05-29-2015 01:01:48.091 +0530 ERROR HttpListener - Exception while processing request from 192.168.56.1 for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+index%3D_internal+(phonehome)+&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&=1432841136381: Connection closed by peer
05-29-2015 01:01:48.091 +0530 ERROR HttpListener - Handler for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+index%3D_internal+(phonehome)+&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&=1432841136381 sent a 0 byte response after earlier claiming a Content-Length of 705!
05-29-2015 01:13:40.401 +0530 ERROR HTTPClient - Cannot resolve IP of host=apps.splunk.com: Temporary failure in name resolution
05-29-2015 01:13:40.401 +0530 ERROR ApplicationUpdater - Error checking for update, URL=/api/apps:resolve/checkforupgrade: Invalid URI

This I have got from "grep -i "error" splunkd.log" in my DS

[woodcock]

post your deploymentclient.conf and the exact error texts.

[abhayneilam]

[root@localhost local]# cat deploymentclient.conf
[target-broker:deploymentServer]
targetUri = 192.168.56.111:8089

---

and below are the error text from the Universal Fowarder ( My Deployment Client )

[root@localhost splunk]# grep -i "Error" splunkd.log
05-28-2015 13:44:10.946 -0500 ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.
05-28-2015 13:54:58.114 -0500 ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.

[abhayneilam]

[root@localhost splunk]# grep -i "reset" splunkd.log
05-28-2015 13:44:09.331 -0500 INFO LMTracker - Setting feature=ResetWarnings state=DISABLED_DUE_TO_LICENSE (featureStatus=2)
05-28-2015 13:54:56.304 -0500 INFO LMTracker - Setting feature=ResetWarnings state=DISABLED_DUE_TO_LICENSE (featureStatus=2)

[emiller42]

Neither of those errors have any relation to the Deployment Server. The TcpOutputProc error means that the client has nowhere to forward events. The LMTracker INFO lines are just noise from the fact that your client doesn't have (or need) a license configured.