List deployment client showing "no clients contacted the server"

[Poojitha]

Hi,

I have set up deployment server. When I checked splunkd_access.log , it shows successful phonehome connection from Heavy Forwarder. I can also see app getting deployed in  deployment clients.

But when I do ./splunk list deploy-clients, it is showing "No deployment clients have contacted this server".

What is going wrong here ? Please can anyone of you help me.

Regards,
PNV

[isoutamo · Accepted solution]

Hi
If your DS is 9.2.x, have you read this https://community.splunk.com/t5/Deployment-Architecture/The-Client-forwarder-management-not-showing-...?
r. Ismo

[Poojitha]

Thanks @isoutamo  Thank you. Now I see the deployment clients are being listed using the command .
./splunk list deploy-clients.

I added the stanza under /opt/splunk/etc/system/local/outputs.conf following the link you posted.

[indexAndForward]
index = true
selectiveIndexing = true

Thanks again 🙂

Regards,
PNV

[Poojitha]

@isoutamo  : Thanks for the links you provided.

I see that my old DS lists all clients contacting. It is running 9.0.2. Where as the new one which I am trying to setup is running 9.2.1. I see from the links that, it is because of the version difference.

However , I tried the steps provided in the link. Still no luck. 

I also should mention that I am configuring this DS to act as log forwarder as well. So, it is that both of these setup is making use of same splunk service. Does this have any effect on proper working of Deployment Server.
Do you have any comments ? Apart from the steps in above link , do you have any other suggestion.

Thanks in Advance,
PNV

Regards,
PNV

[isoutamo]

If I have understand right this is doable also on IHF + DS combination, but it could be tricky as those functions are different. Also if you have more than 50 client then you should/must have a separate DS server for those.

Since 9.2.x DS server expects that there are some local indexes where it stores information about DS actions. If you haven't those or you are sending all events into your real indexers then this didn't work.

If I recall right there are some instructions how this can do, but I prefer that you will install one new dedicated server for DS and use those local indexes for DS function. That way it will be much easier to get it to work.

Other option is look from community, docs and Splunk usergroup Slack how this can do in combined IHF + DS. It needs some additional tuning for outputs.conf at least, maybe it was some other conf files too?

[splunkreal]

Hello @Poojitha  you can try splunk list deploy-clients -count -1

Also you should use Settings/Forwarder management (GUI interface of your DMC server).

[Poojitha]

@splunkreal  : Thanks .. I tried the command but no luck 😞