Hi, I had this issue and the answers given all hold merit and should be followed/checked. However, I would like to add 1 other check, and this caught my team out for awhile. Check on the deployment server, splunkd.log for 'duplicated' GUID messages, (I can't remember the exact error message, its been a awhile!). Our problem was caused by 'designers' and jump server builds pushing same Splunk config builds on new builds.
If you do see this Error in Splunkd.log, then, (it will provide hostnames/IP Addresses) log onto those servers, stop Splunk.
Delete "/opt/splunk(forwarder)/etc/instance.cfg" - on both servers. Restart splunk, duplicated problem disappears as new GUID is created per machine, (deployment server is now happy), and any apps are then pushed down.
... View more