https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450484#M1497 <P>Is there any way that i could stop seeing logs from the particular server?</P> Thu, 06 Sep 2018 17:13:34 GMT saran53 2018-09-06T17:13:34Z https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450477#M1490 <P>Have removed a server from the serverclass.conf file and did reload and restart as well, but the server is still displayed in Splunk GUI for the same index. </P> <P>Windows server which was present in serverclass.conf is decommisioned and hence i edited serverclass.conf to removed the existing server and added the new one...but i can still see logs from the removed server in GUI.</P> <P>Is there any way that i could stop seeing logs from the particular server?</P> Thu, 06 Sep 2018 14:23:17 GMT https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450477#M1490 saran53 2018-09-06T14:23:17Z https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450478#M1491 <P>Hello @saran53 </P> <P>Dd you try to remove the server using GUI through deployment server?</P> <P>Is there any condition mentioned which is adding the server again in serverclass.conf?</P> Thu, 06 Sep 2018 15:17:31 GMT https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450478#M1491 vishaltaneja070 2018-09-06T15:17:31Z https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450479#M1492 <P>Have manually edited the serverclass.conf file in deployment server and not through GUI. Could not see server added again in serverclass.conf....<BR /> checked serverclass.conf file multiple times and ensured that the server name doesnot exist in it</P> Thu, 06 Sep 2018 15:26:14 GMT https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450479#M1492 saran53 2018-09-06T15:26:14Z https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450480#M1493 <P>Where is your serverclass.conf file located?</P> Thu, 06 Sep 2018 15:33:22 GMT https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450480#M1493 integratorz 2018-09-06T15:33:22Z https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450481#M1494 <P>/opt/app/ecomm/splunk/etc/system/local/serverclass.conf</P> Thu, 06 Sep 2018 16:49:02 GMT https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450481#M1494 saran53 2018-09-06T16:49:02Z https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450482#M1495 <P>Am I correct in assuming you are trying to stop a server from receiving a TA with an input in it? If not, can you elaborate more on what you are trying to accomplish?</P> Thu, 06 Sep 2018 17:03:32 GMT https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450482#M1495 integratorz 2018-09-06T17:03:32Z https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450483#M1496 <P>Windows server which was present in serverclass.conf is decommisiomed and hence i edited serverclass.conf to remove the existing server and added the new one...but i could still see logs from the removed server in GUI under same index</P> Thu, 06 Sep 2018 17:11:44 GMT https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450483#M1496 saran53 2018-09-06T17:11:44Z https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450484#M1497 <P>Is there any way that i could stop seeing logs from the particular server?</P> Thu, 06 Sep 2018 17:13:34 GMT https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450484#M1497 saran53 2018-09-06T17:13:34Z https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450485#M1498 <P>What are your time constraints for the search? If the events from that host fall under the time range you are selecting, you are still going to see the host. Once the events age out of that range you will no longer see them.</P> Thu, 06 Sep 2018 20:37:58 GMT https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450485#M1498 integratorz 2018-09-06T20:37:58Z https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450486#M1499 <P>I am searching out of the range only like one minute a ago and could see logs for current minutes</P> Sat, 08 Sep 2018 09:19:37 GMT https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450486#M1499 saran53 2018-09-08T09:19:37Z https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450487#M1500 <P>Hi there,</P> <P>Run this command and see if windows server shows up. <CODE>splunk btool serverclass list --debug | grep 'your_windows_servername'</CODE> I often land up in situations where I have 2 serverclass.conf files, one in $SPLUNK_HOME/etc/system/local and another in $SPLUNK_HOME/etc/apps/search/local. </P> Tue, 29 Sep 2020 21:13:32 GMT https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450487#M1500 sudosplunk 2020-09-29T21:13:32Z https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450488#M1501 <P>After removing a server from a server class you can still see it in the deployment server (e.g client with deployment server ip configured when the forwarder was installed)<BR /> Along with deploymentclient.conf I'm guessing the inputs.conf on that decommissioned server were not deployed by deployment server. Check the decommissioned server it self for configurations in splunk/etc/system/local</P> Tue, 11 Sep 2018 18:09:58 GMT https://community.splunk.com/t5/Splunk-ITSI/Why-are-my-Serverclass-conf-changes-not-reflecting-in-the-Splunk/m-p/450488#M1501 diogofgm 2018-09-11T18:09:58Z