Getting Data In

Why is my deployment client showing as disabled and says splunkd needs to be up, but it already seems to be?

pipegrep
Path Finder

I'm troubleshooting a deployment client and I've gotten stuck;

Deploy server
$ /splunk/bin/splunk --version
Splunk 6.1.4 (build 233537)
Note: This server deploys apps successfully to 125+ clients.

Deploy client
$ /opt/splunkforwarder/bin/splunk --version

Splunk Universal Forwarder 6.1.5 (build 239630)

The problem; no deployments.

$ /opt/splunkforwarder/bin/splunk display deploy-client
Deployment Client is disabled.
This command [GET /services/messages/restart_required/] needs splunkd to be up, and splunkd is down.

$ service splunk status
Splunk status:
splunkd is running (PID: 4922).
splunk helpers are running (PIDs: 4923).

Other than the obvious need to upgrade, does this indicate a glaring mistake I'm missing or is this more subtle? Currently setting up log debugging to see if I can learn more.

Thanks.

0 Karma
1 Solution

pipegrep
Path Finder

Sorted it out. Client config had a missing parameter.

View solution in original post

0 Karma

josiahv92
Loves-to-Learn

Also, if its a new instance, make sure the management port 8089 is open on Splunk instance's firewall.

0 Karma

vulnfree
Explorer

What was the solution @pipegrep?

Thembekile
Loves-to-Learn Lots

Did anyone ever find the solution to this problem. The whole missing parameter thing is not too helpful

0 Karma

lguinn2
Legend

The error message

This command [GET /services/.....] needs splunkd to be up, and splunkd is down.

could mean that splunkd is down, but it almost always means

"There was a syntax error in your command and the CLI was not smart enough to throw a decent error message. Or maybe splunkd didn't return a decent error code for the CLI to report back to you."

Basically - there is a typo.

pipegrep
Path Finder

Sorted it out. Client config had a missing parameter.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...