topic Splunk 6 Forwarder Management Question in Deployment Architecture

Splunk 6 Forwarder Management Question

dshakespeare_sp — Fri, 10 Jan 2014 17:39:30 GMT

Scenario

Upgraded from Splunk 4 to Splunk 6.
Using deployment server to distribute apps

There are a large number of clients
The target clients are placed in groups by setting common clientNames in deploymentclient.conf
eg clientName=womble

In serverclass.conf the class is defined :-

[serverClass:wombles]

[serverClass:wombles:app:myapp]
whitelist.0 = womble
restartSplunkd = true
continueMatching = false

This used to deploy on Splunk v4 but does not on Splunk v6.0

If this is added:

[global]
whitelist.0 = *

The app is deployed to everything, not just the intended nodes

I believe the above config is not compatible with the forwarder management GUI - but should still work

If I move the whitelist to serverClass level it works
Any ideas?

Re: Splunk 6 Forwarder Management Question

hexx — Fri, 10 Jan 2014 19:02:33 GMT

UPDATE: After further research, the first assumption below turns out to be incorrect: It is not necessary for each deployment client to be configured with a unique clientName.

The target clients are placed in groups by setting common clientNames in deploymentclient.conf

I think that you are breaching a basic client/server contract for this feature by giving the same clientName to more than one client. Although the spec file for deploymentclient.conf doesn't say so, I'm fairly certain that each client should have a unique clientName or all bets are off.

I'd suggest addressing that problem and seeing if things work again as you would expect.

I believe the above config is not compatible with the forwarder management GUI

That is correct. App-level directives in serverclass.conf are not supported by the Forwarder Management UI.

Re: Splunk 6 Forwarder Management Question

V_at_Splunk — Fri, 10 Jan 2014 23:31:09 GMT

hi dshakespeare_splunk,

Please:

post your entire serverclass.conf
specify exactly what you mean by "does not work": what behavior is observed, and how is this different from the expected behavior?

Re: Splunk 6 Forwarder Management Question

dshakespeare_sp — Mon, 13 Jan 2014 12:01:07 GMT

Above is the complete file.
Looking at spec file - it appears we do not support whitelist at app level only global and serverClass level

Re: Splunk 6 Forwarder Management Question

bmunson_splunk — Wed, 27 Aug 2014 00:30:50 GMT

In the current version, you have the whitelist in the wrong location. It should be under the main server class stanza not it's child app one. As below.

[serverClass:wombles]
whitelist.0 = womble

[serverClass:wombles:app:myapp]
restartSplunkd = true
continueMatching = false