Hello,
I've read a few threads on this topic, but none seem to relate to Splunk 6.3 or have worked for me.
I am taking over a deployment that looks like 10 servers that forward data to a Heavy Forwarder, which then forwards the data to my main Splunk Indexer. All of the servers have a Universal Forwarder installed. 5 of the servers are throwing me this message in the splunkd.log file:
02-05-2016 11:46:13.528 -0500 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected
Any suggestions on what this could be? I've checked the files to make sure they are all the same, but I am not finding the issue. Maybe I'm overlooking something.
↧
Why am I getting handshake error between my deployment server and 5 out of 10 universal forwarders?
↧