Getting Data In

Why is my forwarder missing from the list of forwarders?

Hekmel
Engager

I have installed universal forwarders on all of the servers I want to monitor with Splunk. If I go on the Splunk Server to "Settings" -> "Add Data" -> "Forward" I find all but one of the servers in that list. Lets call the server serverx

If I go from the Splunk dashboard to "Search and Reporting" and search for that server that is missing in the forwarders list I find information on it. host=serverx

Is there some way that I can get serverx into the list of forwareders so I can define monitoring parameters for the hosts? Or is there another way of doing this all together?

0 Karma
1 Solution

Hekmel
Engager

Thank you all for suggestions. We ended up adding all the servers via the Linux shell to an application and then it worked regardless if we still cannot select the host from the gui for anything.

View solution in original post

Hekmel
Engager

Thank you all for suggestions. We ended up adding all the servers via the Linux shell to an application and then it worked regardless if we still cannot select the host from the gui for anything.

hardikJsheth
Motivator

Can you check if you have deploymentclient.conf file on your UF? If this file is not present, that means the setup to deployment server is missing and you can refer the link provided by @garethatiag.

In case the file is present check the port connectivity between deployment server and UF. Deployment server requires bidrectional connection between UF and Deployment server for the management port (mostly it's 8089).

ddrillic
Ultra Champion

You can administer the forwarders from two services, the Forwarder management and the Monitoring Console -

alt text

gjanders
SplunkTrust
SplunkTrust

I'm not completely clear on the issue from your description, but it sounds like you might be having an issue with configuring a universal forwarder to talk to the deployment server?
If so then the configure deployment clients documentation might help

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...