Need help with Deployment Server – Clients not showing up

[BraxcBT]

Hi team,

I need some help with setting up the Splunk Deployment Server.

I’ve configured the deploymentclient.conf file on a Universal Forwarder and set up a server class via the Splunk UI on my Heavy Forwarder, which I'm using as the Deployment Server. However, I’m not seeing the client listed under the server class or in the deployment server's list of connected clients.

Is there anything I might be missing in the setup or configuration?
Any advice would be appreciated!

Thanks in advance!

[PrewinThomas · Accepted solution]

@BraxcBT 

Which version of Splunk are you running?
If you are on Splunk Enterprise 9.2 or later, make sure you have the following configuration to ensure Universal Forwarders show up in the Forwarder Management UI.

add these settings to outputs.conf

[indexAndForward]
index = true
selectiveIndexing = true

#https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/9.2/configure-the-dep...

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[BraxcBT]

Thx, it works

[isoutamo]

FYI: With 9.4 or something there is nasty feature which shows only GUIDs etc. in default field. Fortunately there is setting link/button on headers from where you can select "missing" fields. Unfortunately this is not a permanent settings, so you must do it again and again 😞

[squinlan2]

Would you be able to share a sanitized version of your deploymentclient.conf?

[BraxcBT]

Hi, @squinlan2 

Sure, 

deploymentclient.conf
[deployment-client]
clientName = UF-LAB

[target-broker:deploymentServer]
targetUri = 192.168.*.*:8089

serverclass.conf

[serverClass:windowsAD:app:sendtoindexer]
restartSplunkd = true
stateOnClient = enabled

[serverClass:windowsAD]
whitelist.0 = UF-LAB

I've been doing some tests. I created an app under deployment-apps and then a server class where the client name is UF-LAB. I reloaded the deployment server and the app worked — I can see the server class and the app. However, I don't see the forwarder listed in the UI. Also, when I run the command splunk list deploy-clients, it says:
"No deployment clients have contacted this server."

Can you help me improve this?