Strangely, even the ones i can see in the deployment manager as active report that the server refused the connection? ... View more

I have compared the contents of input.conf in the following location c:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf However they both seem the same with the right host. Unless i am looking at the wrong inputs.conf? A working computer. Contains [default] host = IT1-05-0847 A missing machine [default] host = Admiss-02-0674 ... View more

Thanks, the search index=_internal | stats count by host Does indeed display the missing hosts and the errors. For example 03-23-2012 10:11:43.501 +0000 WARN PubSubConnection - Cannot convert str: to a valid status, returning eRejected. host=6F01-01-1560 Options| sourcetype=splunkd Options| source=C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log ... View more

16.103 is the correct server and 9997 is the correct port.. 03-23-2012 09:53:06.363 +0000 INFO TcpOutputProc - Connected to idx=192.168.16.103:9997 03-23-2012 09:53:11.285 +0000 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected ... View more

Unfortunately not, i have 108 clients forwarding successfully to the server, just application and system logs, which is about 4mb a day a day at the moment. Should be plenty of room for more clients from them numbers. Just not sure why the server is rejecting the additional ones. ... View more

Anyone able to suggest why the server would rejecting additional forwarders? ... View more

Ive Checked the outputs.conf on the client and that is pointing to the correct server and port. the splunkd.log says ... 03-22-2012 10:20:14.085 +0000 WARN PubSubConnection - Cannot convert str: to a valid status, returning eRejected. 03-22-2012 10:20:25.804 +0000 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected 03-22-2012 10:20:37.819 +0000 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected 03-22-2012 10:20:49.819 +0000 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected 03-22-2012 10:21:01.819 +0000 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: rejected ... View more