Universal Forwarders not showing up after a while from forwarder management on deployment server

[moriteza]

Hi all,

Multiple universal forwarders are installed on both Windows and Linux, and they work fine. The deployment server forwarder management tabs no longer show them; however, after making changes to apps in /opt/splunk/etc/deployment-apps/app, they called the deployment server and received the changes, but still have issues with managing them.

I found a lot of logs on the search-head when I checked the internal index:
INFO DC:DeploymentClient [8072 PhonehomeThread] - channel=deploymentServer/phoneHome/default Will retry sending phonehome to DS; err=not_connected
There is no problem connecting from UF to DS on port TCP 8089.

Does anyone have any ideas on how I could solve this?
DS version = 9.3.1
UF version = 9.3.1
$splunk show deploy-poll
Warning: Attempting to revert the SPLUNK_HOME ownership
Warning: Executing "chown -R splunkfwd:splunkfwd /opt/splunkforwarder"
Deployment Server URI is set to "10.121.29.10:8089".

[PrewinThomas]

@moriteza 

If it's after upgrading to 9.2+, add below configuration under outputs.conf in the deployment server, then restart splunk service in the deployment server.

[indexAndForward]
index = true
selectiveIndexing = true

#https://community.splunk.com/t5/Deployment-Architecture/The-Client-forwarder-management-not-showing-...
#https://help.splunk.com/en/splunk-enterprise/administer/manage-and-update-deployment-servers/9.2/con...

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[SanjayReddy]

Hi @moriteza 

are you facing this issuse after updating deployment server to 9.2 and above?

if yes.  follow thses steps. 

there is known issue in Splunk 9.2.x deployment clients will not show in forwarder managment apps.

you need to add following config in deployment server outputs.conf and restart deployment server

[indexAndForward]
index = true
selectiveIndexing = true

full link to issue 

https://help.splunk.com/en/splunk-enterprise/administer/manage-and-update-deployment-servers/9.2/con... 

[tej57]

Hey @moriteza,

I've seen this happen generally when there's a large deployment and the DS is unable to handle the load. I've come across one of the apps that we have developed which is quite fast and easy to manage the deployment clients - https://splunkbase.splunk.com/app/7731. Please give it a try and let us know the feedback.

Thanks,
Tejas.

---
If the above solution helps, an upvote is appreciated..!!