Agreed. I think the term itself caused a bit of alert. "Phone Home" is the term used with Command and Control traffic where the pwned bot calls back for the hackers instructions. Maybe it would be better to use the term "Deployment server poll" or similar. Thanks, Ferdie ... View more

Well, nevermind. I changed my firewall to allow all traffic, and now it works. I have the Forwarder communicating and configured on my "instance." Whew, that only took 4 hours. 🙂 ... View more

Thanks for that Ogdin. I tried that, but still don't get any traffic past my firewall policy. The new log entry is: DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected ... View more

I'm having the same problem. Why does the Forwarder default to pot 9997, but the Splunk Light instance only listen on 8087? Also, when I enter in the splunk set dploy-poll.10.1.1.1:8087, I get asked for a Splunk user/pass. My instance account didn't work. ... View more