Brilliant! Used this twice now and it worked each time, with the 2nd host I had to remove the UpgradeCodes entry as well. ... View more

Hello cutright_jm Try binding Splunk's port 8089 to an IP to address the web interface: Kindly see this documentation below: https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/BindSplunktoanIP As for the deployment_client role, i believe you have created a deploymentclient.conf which the Forwarder is reporting to the Deployment Server. You can verify this by checking the Forwarder Management on the Deployment Server. You can just directly set the Forwarder to forward logs to the Indexer by just configuring its outputs.conf. The only downside to this one is you can't push apps to the Forwarder. Hope it helps! Thanks! ... View more