Deployment Architecture

Communication between deployment server and client is not established.

swapsplunk236
Explorer

Hi All,

We have 300+ servers in our environment and already reporting to Splunk. We are trying to add 5 more servers but the communication between deployment client and deployment server is not getting established. Below is netstat output from deployment server.

Active Connections

Proto Local Address Foreign Address State
TCP A.B.C.D:3389 ABC:65062 ESTABLISHED
TCP A.B.C.D:8089 10.1.1.1:56008 TIME_WAIT
TCP A.B.C.D:8089 1.2.2.4:56671 TIME_WAIT
TCP A.B.C.D:8089 2.2.3.4:56673 TIME_WAIT

We have checked telnet on port 8089 is working in both ways. Can you please suggests some checks that we should perform?

Thanks in advance.

1 Solution

swapsplunk236
Explorer

Hi All, Issue got resolved when I installed older version of Splunk universal forwarder. DS was running on 6.3.1 while I was installing latest versions of Splunk UF. Downgrading them to 6.3.1 worked.

View solution in original post

swapsplunk236
Explorer

Hi All, Issue got resolved when I installed older version of Splunk universal forwarder. DS was running on 6.3.1 while I was installing latest versions of Splunk UF. Downgrading them to 6.3.1 worked.

woodcock
Esteemed Legend

If you can telnet but DC cannot get to DS then the only thing that makes sense is that you have 2 NICs on that server and you are using one (that works) and Splunk is locked to the other (that is missing a route or ACL or something).

0 Karma

swapsplunk236
Explorer

Hi, Thanks for your suggestion. We checked this on the server with single nic but issue persisted. Later, When I installed older version of universal forwarder on the server, it started to report. Now, I suspect issue is with version compatibility .We are running 6.3.1 version of Deployment server, and were installing the latest versions of Universal forwarder on server. I need to check again by installing older versions of universal forwarder on other servers. Hoping for positive result.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...