I understand what you are saying for me to do, however my customer has asked me to put it back to a simpler configuration. It means changing it back to 2 indexers without the rest of the servers as my replacement will probably not have the knowledge and experience that I have. That is not saying that I have a lot either. That is why I am asking for assistance in doing this. So if there is anyone who can assist me, I would greatly appreciate it. Robert ... View more

I created an app called deploymentclient and it has within it local/deploymentclient.conf. With this set up, it seems to be working and so far my workstation is still talking to the deployment server. Now when I start installing UFs on other systems, I will have to be aware of it. I just wish that there was a script to remove it from a host automatically. Thanks again. ... View more

Thanks for the info.... With all the searching that I did, I never found anything that would say that you need to remove the /etc/system/local deploymentclient.conf file. It always said that it would overrule anything else that you try. So, I do have an app with the appropriate file in it. I guess I just have to go into every UF client and delete the original one and then see how it behave. The first one is my computer to see how it works. ... View more

I have been trying to do this change for a few days. I understand putting the deploymentclient.conf in the /etc/apps folder, but how do I override the one in /etc/system/local directory? I am trying to migrate all my UFs to the new forwarder manager/distribution server, but am unsuccessful. I did manage to move two hosts, of course I had to reinstall the UF. I really want the others to move, without having to touch everything. I also just created new server classes on the new distribution server, rather than copy everything over. I guess at this point, I would like to attack this using a scripted input that will edit $SPLUNK_HOME/etc/system/local/deploymentclient.conf. I just don't know how to accomplish this. Any assistance would be greatly appreciated. Thank you in advance. ... View more

I ran ps -ef and it shows splunk started. There is nothing that showed it stopped. Okay, I look at the splunkd and metric logs, but what do I look for? All signs point that it is working, but nothing is reaching the indexer. The last time this server had even communicated was 1/6/21, but there was no metrics being sent. So that is what started me on chasing this rabbit, down the hole and found the two splunk installs... ... View more

here is what is in the outputs.conf file in the /etc/system/local [tcpout] defaultGroup = default-autolb-group   [tcpout:default-autolb-group] server = x.x.x.103:9997 [tcpout-server://x.x.xx.103:9997] ... View more

the first issue was that I could not uninstall because there were two versions installed... .tgz version 7.3 and .rpm 8.1.1. Here are the results for each one that you asked in regards to the communication. index=_internal host=<host/ip>    There was nothing returned.  btool outputs list | less    tcpout-server://x.x.x.103:9997 btools inputs list | more  host=$decideOnStartup$ connection_host=ip index=default ... View more

I ran the tcpdump command and the communication showed was between a virtual server on this Linux server and the indexer. The Linux server itself doesn't show up. At this point, I am thinking of uninstalling the UF completely and reinstall after this server is upgraded which is supposed to be this year. ... View more

splunkd.log shows that everything seems to be working fine. In the metrics log, it seems that there is nothing collected and sent, but not really sure about it. I did find that there is this line that makes it seem that it is trying to communicate with the indexer and DS. INFO StatusMgr - destHost=<ip>, destIp=<ip>, destPort=9997, eventType=connect_try,  publisher=Tcpout, sourcePort=8089, statusee=TCPOutputProcessor INFO StatusMgr - destHost=<ip>, destIp=<ip>, destPort=9997, eventType=connect_fail,  publisher=Tcpout, sourcePort=8089, statusee=TCPOutputProcessor ... View more

There is an outputs.conf file which is showing that there is an indexer and listening on port 9997, but it is showing as inactive. There is no DS (Deployment server) that is listed. ... View more

I did try that too. Even when I do the rpm -e splunk8.x.y... it still told me that it was not installed. Support had me do the install with the tar file. I now have the UF installed, but the problem now is that the it is not communicating with the indexer. ... View more

Per Support, I did do the installation using the tar file sudo tar xvzf /tmp/splunk.tgz Splunk is there, just like when I do the .rpm. The problem I am faced with is that it isn't communicating with the indexer. I may have to just remove the UF all together until that server is rebuilt. ... View more

I ran the following command as you suggested. sudo rpm -Uvh --replacepkgs (or --force) ./splunkforwarder-8.x.y-xxxx.rpm It seemed to install fine, but it never reported into the indexer. I did some poking around in man rpm and decided to run rpm -evv --test splunkforwarder-8.x.y-xxxx.rpm What returned looked like it would uninstall fine. I checked the splunkd.log to see if there was any indications or error related to the installation or in fact anything and I found none, so my assumption is that everything is supposed to be okay. My next step was to stop splunk and then uninstall. I ran the uninstall command from /opt/splunkforwarder/bin since I was there rpm -e splunkforwarder-8.x.y-xxxx.rpm I received the following message: Warning: file /opt/splunkforwarder/ftr: remove failed: no such file or directory. I guess I was in the wrong directory so I reran the command from /opt and this error appeared Error returned "package splunkforwarder-8.x.y-xxxx.rpm is not installed.  Anyway, I looked in the directory and the splunkforwarder directory was there. I checked it and found only etc and var was there. So I am not sure if it would be prudent for me to remove the splunk forwarder directory and reinstall, like maybe using tar splunkforwarder-8.x.y-xxxx.tgz? I look forward to your response. Thank you ... View more

I had done splunk disable boot-start before I uninstalled. The problem was that there was the .tgz and .rpm both installed at the same time. I am trying to clean it up, so that I can properly reinstall. Thanks for the suggestion. ... View more

Here is the results: rpm -qa | egrep splunk splunkforwarder-8.1.1-08187535c166.x86_64 rpm -qif /opt/splunkforwarder/bin/splunk Name: splunkforwarder Version: 8.1.1 Release: 8.1.1-08187535c166 etc..... If these commands show that it is installed, why then when I try to do an uninstall to clean up, it tells me it is not installed. Of course, that is why when I try to reinstall, I get the it is already installed. Thanks! ... View more

After running the command  'rpm -qi splunk\* ', the response was package splunk is not installed. ... View more

That doesn't work... It thinks that it is already installed and I can't uninstall it either. I am finding that the only option is to install a version that wasn't previously installed and see how that goes. If it fails, then I will have to submit a case. ... View more

Did you ever create alerts for disk performance from this app? I am trying to develop alerts based on different iostat metrics. ... View more

@gjanders, I found an app and associated TA, SA that provides that kind of data. Look at the Metricator app https://splunkbase.splunk.com/app/3947/ https://splunkbase.splunk.com/app/3948/ (Technical Add On) https://splunkbase.splunk.com/app/3949/ (Support App) ... View more

I tested the regex that I had and that you verified as good. Even though it does not produce errors and I would eventually like to use this format to filter subnets, I had to go through the less fancy way and just put the hostnames of the workstations. Since there are a few varieties, I just did a portion of the name and then added an '*' at the end.It filters properly and I have the only workstation that I have using a UF. So I switched to this for the sake of expediency. It may not look sexy or fabulous that can give a lay person a headache, but it's functional with the hostnames. Of course, in the other server class for essentially windows servers, I had to blacklist the same hostnames. Thanks jnudell_2 for your help and assistance on regex expression for IPs and the explanation. ... View more

I tried that... Although I didn't get the error as I found the syntax issue (fat fingering). I kept trying and it says nothing matches even though there is one workstation with an IP that matches the whitelist filter. Quite frustrating. If you have any other ideas, let me know. Maybe I should Blacklist every other device's IP or ranges? ... View more

So, I am getting closer. I eliminated the $. When I save and then go back to look at the parameters because it says that I haven't added any clients, I am greeted with this error: In handler 'serverclients': Regex: missing terminating ] for character class. I have been searching for an answer on line, but I have yet to find one that applies. Any ideas? ... View more