topic Re: Splunk Light: Server Classes in Splunk Enterprise

Splunk Light: Server Classes

cmschube — Fri, 24 Jul 2015 15:34:51 GMT

This questions was asked before, but still haven't gotten a really good answer out of it. Or maybe I'm just doing this all wrong.

I'm trying to use Splunk Light to monitor the Security Logs of several Windows devices. Whenever I add a new host to monitor, rather than being able to add the host to the Server Class that I have called "Windows Hosts" in the "Data Inputs -> Event Logs Collections" page, I have to create a new Server Class and add all the hosts again to the new class. If I try to click on the existing Server Class to edit it, I get a "Page Not Found" message.

Is this correct? Am I doing something wrong? Is Light only supposed to be used for one device?

Re: Splunk Light: Server Classes

ChrisG — Fri, 24 Jul 2015 16:17:06 GMT

The best answer I could find out is the one I posted here:

Deployment server does not work in Splunk Light today. Because Splunk Light and Splunk Enterprise share a code base and the UI is defined by licensing, there are a few defects where features that are only available in Enterprise partially appear in Light. That is why you are seeing that server class link.

Re: Splunk Light: Server Classes

cmschube — Fri, 24 Jul 2015 16:23:40 GMT

Hey Chris -

Thanks, that makes sense. So, I guess having to go back and add a new server class every time I add a new host, is that "correct" procedure?

Re: Splunk Light: Server Classes

ChrisG — Fri, 24 Jul 2015 18:02:32 GMT

It seems you're into a buggy area of the product here. If your suggestion works for you, try it! And if you are a paying customer, I suggest opening a Support case for this.