I'm running Version 10.2.0, Build: d749cb17ea65 -- on RHEL 10 as a Systemd service I've registered 2 Heavy Forwarders with a Deployment Server but I'm not seeing them show up in Agent Management. Things I've checked: - all host firewalls are configured correctly; tested temporarily disabling also with no luck - no selinux issues seen in /var/log/audit/audit.log On the deployment server, I am seeing both heavy forwarders connecting: /opt/splunk/var/log/splunk/splunkd_access.log: 10.4.0.32 - - [20/Feb/2026:16:41:56.627 -0500] "POST /services/broker/phonehome/connection_10.4.0.32_8089_sec-splhf-prd2.domain.com_sec-splhf-prd2_linux-x86%2564_EE8DB183-659C-47E2-8166-05C9B6CB8B8F_EE8DB183-659C-47E2-8166-05C9B6CB8B8F HTTP/1.1" 200 477 "-" "Splunk/10.2.0 (Linux 6.12.0-124.38.1.el10_1.x86_64; arch=x86_64)" - - - 1ms 10.4.0.32 - - [20/Feb/2026:16:42:56.635 -0500] "POST /services/broker/phonehome/connection_10.4.0.32_8089_sec-splhf-prd2.domain.com_sec-splhf-prd2_linux-x86%2564_EE8DB183-659C-47E2-8166-05C9B6CB8B8F_EE8DB183-659C-47E2-8166-05C9B6CB8B8F HTTP/1.1" 200 35 "-" "Splunk/10.2.0 (Linux 6.12.0-124.38.1.el10_1.x86_64; arch=x86_64)" - - - 0ms .. .. 10.4.0.31 - - [20/Feb/2026:16:47:31.639 -0500] "POST /services/broker/phonehome/connection_10.4.0.31_8089_sec-splhf-prd1.domain.com_sec-splhf-prd1_linux-x86%2564_AB8B7A26-21A4-4B2A-A91B-52AAA16482CE_sec-splhf-prd1 HTTP/1.1" 200 447 "-" "Splunk/10.2.0 (Linux 6.12.0-124.38.1.el10_1.x86_64; arch=x86_64)" - - - 1ms 10.4.0.31 - - [20/Feb/2026:16:48:31.646 -0500] "POST /services/broker/phonehome/connection_10.4.0.31_8089_sec-splhf-prd1.domain.com_sec-splhf-prd1_linux-x86%2564_AB8B7A26-21A4-4B2A-A91B-52AAA16482CE_sec-splhf-prd1 HTTP/1.1" 200 447 "-" "Splunk/10.2.0 (Linux 6.12.0-124.38.1.el10_1.x86_64; arch=x86_64)" - - - 2ms /opt/splunk/var/log/splunk/splunkd.log: 02-20-2026 16:44:03.538 -0500 INFO PubSubSvr [786945 TcpChannelThread] - Subscribed: channel=tenantService/handshake/reply/sec-splhf-prd1/AB8B7A26-21A4-4B2A-A91B-52AAA16482CE connectionId=connection_10.4.0.31_8089_sec-splhf-prd1.domain.com_sec-splhf-prd1_linux-x86%64_AB8B7A26-21A4-4B2A-A91B-52AAA16482CE_AB8B7A26-21A4-4B2A-A91B-52AAA16482CE listener=0x7ff2a47fb800 02-20-2026 16:45:19.721 -0500 INFO PubSubSvr [788090 TcpChannelThread] - Subscribed: channel=tenantService/handshake/reply/sec-splhf-prd1/sec-splhf-prd1 connectionId=connection_10.4.0.31_8089_sec-splhf-prd1.domain.com_sec-splhf-prd1_linux-x86%64_AB8B7A26-21A4-4B2A-A91B-52AAA16482CE_sec-splhf-prd1 listener=0x7ff290110800 on the deployment server when I run: sudo -u splunk /opt/splunk/bin/splunk list deploy-clients WARNING: Server Certificate Hostname Validation is disabled. Please see server.conf/[sslConfig]/cliVerifyServerName for details. No deployment clients have contacted this server. I configured both heavy forwarders to point to the deployment server using: sudo -u splunk /opt/splunk/bin/splunk set deploy-poll sec-spldpl-prd1.domain.com:8089 There could be a bug here, since the 1st time I ran the command it prompted for credentials, and only generated deploymentclient.conf with: [target-broker:deploymentServer] Running it a 2nd time resulted in: [target-broker:deploymentServer] targetUri = sec-spldpl-prd1.example.com:8089 (I restarted Splunkd service after) According to the documentation: The deploymentclient.conf file requires two stanzas: [deployment-client] [target-broker:deploymentServer] Based on this, I edited the file and added the missing stanza: [deployment-client]
[target-broker:deploymentServer]
targetUri = sec-spldpl-prd1.example.com:8089 .. no luck.. I have a server class configured on the deployment server and also created an empty application (base_connectivity) .. subsequently Splunk seems to have autocreated "splunk_ingest_actions" Any ideas? I've got a 9 server configuration: 2 search heads 3 indexers 2 Heavy Forwarders 1 Deployment Server 1 Combo Server (license manager, cluster manager, monitoring console)
... View more
