Is the component in _internal dropped for the deployment clients connects ( component DeploymenServer) ?
I believe that to get the client you could use :
index=_internal source=splunkd.log component="DeploymentServer" | dedup hostname | table hostname
The clients themselves will log events as DeploymentClient (typically when the server has issued splunk reload deploy-server
to update the class definitions. It will also log DeployedApplication when the client has downloaded and installed a new app.
The server will log PackageDownloadRestHandler messages in splunkd.log (including the IP of the client) when a client downloads an application. The server also logs client connections (even when no apps are being deployed) in splunkd_access.log, with the 'phonehome' keyword. Information about the client is logged here, such as its IP, server name (as defined in server.conf), etc.
yeah, or is ariving at the deploymentbox, i can control them now but was focus on the component deploymentserver which is gone in splunk.d log
Components are gone? Perhaps I misunderstood the nature of your question? What exactly are you trying to figure out? Whether an individual client has connected?
cool, indeed it looks like the components are gone,,,,guess time for a deployment config monitor?