I am relatively new to Splunk, In my environment we are using deployment server to manage the deployment apps on universal forwarders.
During the installation of universal forwarders, we specify the deployment server in deployment.conf.
But we have not mentioned anything about forwarding the data to the heavy forwarder (HF).
On the web interface of our heavy forwarders, under forwarding and receiving, I cannot see any configuration set up.
How can I check whether universal forwarders are sending data to HF? Are indexers or data getting managed by the deployment server?
I don't have access to the universal forwarders as these are managed by some different team.
So I have to check the configuration within the HF, Indexer or deployment servers.
You need to open up that port for sending data into your Deployment server.
If you have any FW on your env, you need to probably open that up too
You can use below query to check which servers (Universal Forwarders, Heavy Forwarders, Search Heads OR any other Splunk servers) are sending data to Indexers.
index=_internal host=INDEXER_SERVERNAME source=*metrics.log* group=tcpin_connections | dedup hostname | table _time hostname os arch version sourceIp destPort fwdType ssl
In above query if you change
HeavyForwarder_SERVERNAME you will able to figure out if any universal forwarders are sending data to Heavy Forwarder or not.
I didn't get your question
Data is getting managed by Deployment server?, Deployment server will deploy configuration to UF, Heavy Forwarders etc. but it will not manage any data.
Thanks for your answer, I was not sure yesterday whether deployment server can manage the data as well or just apps, did some more research and found my answer.
Thanks for your support.