The Deployment Server represents 'home' to ONLY those nodes running a forwarder client (who can then 'phone home' to the deployment server). The deployment server should not be running a universal or heavy forwarder because you are running the core enterprise software, wherein, you are directing output (_internal index goodies) directly to the indexer (forwarding and indexing configuration). Both the forwarder and the core installation utilize the splunkd process, so cannot physically both be running on the same node. The deployment server is 'home' and the source of your forwarder inputs sent to your forwarding nodes. I hope this helps. In Splunk search for the log entry above and take note of the 'source' and 'host' values. This will tell you which node is responsible for generating the event. ... View more

Problem solved... I am working with a vendor that provides Splunk as part of their package. This is both good and bad. In the script I developed to monotier and report, I was writing one of my files to a folder that the vendor's software monitored. Whenever I updated that file (once a minute) then vendor's software kicked off a re-deployment on the deployment server. Since I was doing this every minute it eventually caused splunnd to throw up on my job scheduler and anaytics. Not writing to the folder fixed this issue. I am now using the REST interface to gather deploy-clinent, and search-server information one a minute without error. ... View more