Are you running the 32bit version of Splunk? 64bit? What about other network interfaces? What is your /sbin/ifconfig output? Is this a VM or physical hardware? Lastly, are you able to install and run say Apache without issue? I ask because I've tried this several times locally and I can't replicate it... and I like a good problem so you have my attention 🙂 ... View more

Are you having issues with scripts not being runnable after deployed by the Deployment Server? Or are you having issues with the Deploy Server not updating the apps on the client properly? ... View more

Do the following steps: 1) Disable the applications on the servers with Forwarders using the Deployment manager (or manually do so using the GUI) 2) On the Index server, stop Splunk and clean all event data for a given index: /opt/splunk/bin/splunk stop /opt/splunk/bin/splunk clean eventdata dev_tools 3) On the servers with Splunk Forwarders, stop and clean all: /opt/splunk/bin/splunk stop /opt/splunk/bin/splunk clean all 4) Start the Splunk Indexer /opt/splunk/bin/splunk start 5) Verify the index you just cleared is empty and is staying empty before proceeding. If it isn't staying empty ensure you've disabled the applications on the servers with Splunk Forwarders and make sure you didn't overlook any servers. 6) Start the Splunk forwarder servers: /opt/splunk/bin/splunk start 6) Re-enable the applications via the Deployment Manager or manually using the Agents GUI. Note: Be aware, if you "clean all" on the forwarders you will also clear out the pointers for all indexes and applications so this process is only good to completely re-index an environment environment or set of indexes a set of servers and indexer may contain. Note 2: Don't do this unless your license (and hardware) can handle the spike as you will most certainly index a lot of legacy data if your inputs are setup with wildcard inputs. ... View more

Looks as if I asked too soon! I still had an input active on another host that was forcing itself to report as the host I wanted removed. Once I resolved that issue (issued an update via the Deployment Manager) and then did a clean on eventdata + globaldata I was able to start over again with the host missing. I am still open to ideas on how to remove a host completely from Splunk for future use as I'm sure it will happen ... View more

Yeah I've already implemented a proxy in the past so I'm well aware that it's a viable solution but I am trying to minimize dependencies for Splunkweb being accessible. I definitely need to check into setcap as that is new to me and from that thread it appears that's the solution I am looking for. ... View more