Getting Data In

Why is my deployment client showing as disabled and says splunkd needs to be up, but it already seems to be?

pipegrep
Path Finder

I'm troubleshooting a deployment client and I've gotten stuck;

Deploy server
$ /splunk/bin/splunk --version
Splunk 6.1.4 (build 233537)
Note: This server deploys apps successfully to 125+ clients.

Deploy client
$ /opt/splunkforwarder/bin/splunk --version

Splunk Universal Forwarder 6.1.5 (build 239630)

The problem; no deployments.

$ /opt/splunkforwarder/bin/splunk display deploy-client
Deployment Client is disabled.
This command [GET /services/messages/restart_required/] needs splunkd to be up, and splunkd is down.

$ service splunk status
Splunk status:
splunkd is running (PID: 4922).
splunk helpers are running (PIDs: 4923).

Other than the obvious need to upgrade, does this indicate a glaring mistake I'm missing or is this more subtle? Currently setting up log debugging to see if I can learn more.

Thanks.

0 Karma
1 Solution

pipegrep
Path Finder

Sorted it out. Client config had a missing parameter.

View solution in original post

0 Karma

josiahv92
Loves-to-Learn

Also, if its a new instance, make sure the management port 8089 is open on Splunk instance's firewall.

0 Karma

vulnfree
Explorer

What was the solution @pipegrep?

Thembekile
Loves-to-Learn Lots

Did anyone ever find the solution to this problem. The whole missing parameter thing is not too helpful

0 Karma

lguinn2
Legend

The error message

This command [GET /services/.....] needs splunkd to be up, and splunkd is down.

could mean that splunkd is down, but it almost always means

"There was a syntax error in your command and the CLI was not smart enough to throw a decent error message. Or maybe splunkd didn't return a decent error code for the CLI to report back to you."

Basically - there is a typo.

pipegrep
Path Finder

Sorted it out. Client config had a missing parameter.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...