issue on splunk deployment server forwarder manager

[julianaa85]

hi , in my company we are using splunk enterprise in cluster struct , i recently update my servers not splunk after that and after restarting splunk deployment server all forwarder are trying to do phone call and when trying to listen on deployment servers it reciving the calls but when i check clients on forwarder manager section it is empty , what can i do ?

[danspav]

Hi @julianaa85,

I had a similar issue after upgrading Splunk, where the deployment server UI was blank, but clients were successfully phoning home.

The Deployment Server UI had an update in recent Splunk versions - it now indexes data locally and searches the local data to populate the UI.

The outputs.conf in the deployment server app has this note:

[tcpout]
forwardedindex.2.whitelist = (_audit|_internal|_introspection|_telemetry|_metrics|_metrics_rollup|_configtracker|_dsclient|_dsphonehome|_dsappevent)

# If you have configurations to forward the internal logs to other instances,
# please include the following settings to make sure the deployment server logs
# are indexed locally.
#
# [indexAndForward]
# index = true
# selectiveIndexing = true

Check that you have a file in :
$SPLUNK_HOME/etc/apps/SplunkDeploymentServerConfig/local/outputs.conf
that has that indexAndForward stanza uncommented.

If not, copy the file from default to local (don't update config in the default directory)  and uncomment the stanza then restart Splunk. 

Hopefully that fixes the blank Deployment Server UI for you.