Getting Data In

Why is my deployment client showing as disabled and says splunkd needs to be up, but it already seems to be?

pipegrep
Path Finder

I'm troubleshooting a deployment client and I've gotten stuck;

Deploy server
$ /splunk/bin/splunk --version
Splunk 6.1.4 (build 233537)
Note: This server deploys apps successfully to 125+ clients.

Deploy client
$ /opt/splunkforwarder/bin/splunk --version

Splunk Universal Forwarder 6.1.5 (build 239630)

The problem; no deployments.

$ /opt/splunkforwarder/bin/splunk display deploy-client
Deployment Client is disabled.
This command [GET /services/messages/restart_required/] needs splunkd to be up, and splunkd is down.

$ service splunk status
Splunk status:
splunkd is running (PID: 4922).
splunk helpers are running (PIDs: 4923).

Other than the obvious need to upgrade, does this indicate a glaring mistake I'm missing or is this more subtle? Currently setting up log debugging to see if I can learn more.

Thanks.

0 Karma
1 Solution

pipegrep
Path Finder

Sorted it out. Client config had a missing parameter.

View solution in original post

0 Karma

josiahv92
Loves-to-Learn

Also, if its a new instance, make sure the management port 8089 is open on Splunk instance's firewall.

0 Karma

vulnfree
Explorer

What was the solution @pipegrep?

Thembekile
Loves-to-Learn Lots

Did anyone ever find the solution to this problem. The whole missing parameter thing is not too helpful

0 Karma

lguinn2
Legend

The error message

This command [GET /services/.....] needs splunkd to be up, and splunkd is down.

could mean that splunkd is down, but it almost always means

"There was a syntax error in your command and the CLI was not smart enough to throw a decent error message. Or maybe splunkd didn't return a decent error code for the CLI to report back to you."

Basically - there is a typo.

pipegrep
Path Finder

Sorted it out. Client config had a missing parameter.

0 Karma

reddsbaron
Observer

I have the same issue and even after enabling the deployment client via cli it still says its disabled. What was the fix for your issue?

0 Karma

DanielPi
Moderator
Moderator

Hi @AndySplunks ,

I’m a Community Moderator in the Splunk Community.

This question was posted 9 years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post.

Thank you! 

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...