Hi @heres1 After a Splunk Enterprise upgrade, if Forwarder Management is not showing any "phoning home" (i.e., connected) Universal Forwarders, you probably want to check a few things as below: C...
See more...
Hi @heres1 After a Splunk Enterprise upgrade, if Forwarder Management is not showing any "phoning home" (i.e., connected) Universal Forwarders, you probably want to check a few things as below: Check that the deployment server (Forwarder Management) settings, SSL certificates, and the deploymentclient configuration on your Universal Forwarders are intact and not overwritten by the upgrade. You mentioned restoring the /etc folder I assume this includes the Splunk Secret in etc/auth ? Ensure the deployment server port (default 8089) is up and listening, and network connectivity from forwarders to this port is working. Its worth using curl where possible from one of the UF's to verify this. Check $SPLUNK_HOME/var/log/splunk/splunkd.log on both the server and forwarders for phoning home errors. Upgrades may overwrite configuration files or change SSL settings. If /etc was restored, verify deployment-specific files like deploymentclient.conf (on forwarders) and serverclass.conf (on the deployment server) are correct and certificates/keys are valid. Did you just upgrade the Deployment Server, or the UFs too? As @kiran_panchavat mentioned - there were changed in 9.2 which affect the indexes used for DS data, although you were already on 9.3.1, right? Were the clients definately showing in Forwarder Management / Agent Manager prior to the upgrade? Note: The index configuration changes (https://docs.splunk.com/Documentation/Splunk/latest/Updating/Upgradepre-9.2deploymentservers) do not affect the operation of DS, ie it will still deploy apps to the UFs, they just do not show up in the UI, so its worth confirming that they are still able to access the DS! Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing