https://community.splunk.com/t5/Deployment-Architecture/Best-Practices-Deployment-Server/m-p/236280#M8864 <P>We find that in many cases the Forwarder Management Interface is very slow. Some folks prefer to handle modifying serverclass.conf manually, others prefer the UI. Does this present a problem, as long as we don't step on each other's toes?</P> <P>Also, it looks like Forwarder Management uses apps/search/local/serverclass.conf while the people that have been weaned on manually managing the serverclass.conf file use etc/system/local/serverclass.conf ... Is there a way to force the Forwarder Management UI to use etc/system/local instead of using the one in the 'search' app?</P> Tue, 08 Mar 2016 20:45:09 GMT pkeller 2016-03-08T20:45:09Z https://community.splunk.com/t5/Deployment-Architecture/Best-Practices-Deployment-Server/m-p/236280#M8864 <P>We find that in many cases the Forwarder Management Interface is very slow. Some folks prefer to handle modifying serverclass.conf manually, others prefer the UI. Does this present a problem, as long as we don't step on each other's toes?</P> <P>Also, it looks like Forwarder Management uses apps/search/local/serverclass.conf while the people that have been weaned on manually managing the serverclass.conf file use etc/system/local/serverclass.conf ... Is there a way to force the Forwarder Management UI to use etc/system/local instead of using the one in the 'search' app?</P> Tue, 08 Mar 2016 20:45:09 GMT https://community.splunk.com/t5/Deployment-Architecture/Best-Practices-Deployment-Server/m-p/236280#M8864 pkeller 2016-03-08T20:45:09Z https://community.splunk.com/t5/Deployment-Architecture/Best-Practices-Deployment-Server/m-p/236281#M8865 <P>AFAIK, there is no way to force the Forwarder Management UI to use the system-level serverclass.conf file</P> <P>It would be best if you had only one serverclass.conf file. So if you want to manually edit the file and use the GUI, you will have to user <CODE>etc/apps/search/local/serverclass.conf</CODE></P> <P>There is no problem, as long as two people are not trying to edit the file simultaneously. Also, never forget that you need to run</P> <PRE><CODE>splunk reload deploy-server </CODE></PRE> <P>after any manual edit to serverclass.conf - otherwise the edits in the file will not go into effect until the next Splunk restart. And the edits won't appear in the GUI either, which could lead to confusion...</P> Tue, 08 Mar 2016 22:02:00 GMT https://community.splunk.com/t5/Deployment-Architecture/Best-Practices-Deployment-Server/m-p/236281#M8865 lguinn2 2016-03-08T22:02:00Z https://community.splunk.com/t5/Deployment-Architecture/Best-Practices-Deployment-Server/m-p/236282#M8866 <P>^ Second that best to only have one serverclass.conf file. This can end up causing problems later if you don't get it straightened out soon....apps won't deploy properly, etc.</P> Wed, 09 Mar 2016 01:03:04 GMT https://community.splunk.com/t5/Deployment-Architecture/Best-Practices-Deployment-Server/m-p/236282#M8866 ehorton_splunk 2016-03-09T01:03:04Z https://community.splunk.com/t5/Deployment-Architecture/Best-Practices-Deployment-Server/m-p/236283#M8867 <P>So I just set up a DS myself, and it looks like edits through the GUI actually went to the file at /etc/system/local. I tested with both admin and with another user who's default app was search.</P> <P>This would be the file that your manual editors will have to use.</P> Wed, 09 Mar 2016 16:32:23 GMT https://community.splunk.com/t5/Deployment-Architecture/Best-Practices-Deployment-Server/m-p/236283#M8867 ehorton_splunk 2016-03-09T16:32:23Z