topic Re: Serverclass using CSV in Deployment Architecture

Serverclass using CSV

Murali_Tesco — Wed, 10 Mar 2021 00:26:29 GMT

Hi All,

I have a case where we want to Whitelist servers using a CSV or TXT file,

I tried creating a simple CSV and tried to push the app with no joy, have been trying to look around for any example implementation using the same and i was not able to find any.

Could some body help me.

For testing i am using

[serverClass:test4]
filterType = whitelist
whitelist.from_pathname =/opt/splunk/etc/system/local/test.txt
[serverClass:test4:app:test4]

Thanks in advance

Re: Serverclass using CSV

manjunathmeti — Wed, 10 Mar 2021 06:17:11 GMT

1. Your txt file should contain one <clientName>, <IP address>, or <hostname> is given per line.

printer.splunk.com scanner.splunk.com *.web.splunk.com test.splunk.com

2. Did you restarted splunk once you made changes in /opt/splunk/etc/system/local/serverclass.conf file?

3. Make sure deploymentclient.conf is created in $SPLUNK_HOME/etc/system/local/ in clients with deployment server details.

4. Check if deployment clients and apps are listed in Forwarder Management in the deployment server.

If this reply helps you, an upvote/like would be appreciated.

Re: Serverclass using CSV

Murali_Tesco — Wed, 10 Mar 2021 15:01:53 GMT

@manjunathmeti ,

Thank you for getting back to me, I figured where I was making the mistake.

Because I was giving the full path /opt/splunk/etc/system/local/test.txt, Splunk also adds $SPLUNK_HOME and then it was giving an error stating no such file exist

Then I changed it to etc/system/local/test.txt then it started to work.

Thank you again.