How to deploy the Splunk App for Stream to multiple universal forwarders with different monitoring settings via deployment server?

[kwchang_splunk]

Dear experts,

My customer has 100 universal forwarders and each of the UFs are running the Splunk App for Stream. The problem is that each UF needs to have different settings for monitoring network interfaces. For example, in some UF, only eth8 and eth9 network interface should be monitored and the other network interfaces should be disabled. And another UF needs to monitor eth0 and eth1 only and the others should not be monitored.

He wants to handle the UFs with a deployment server. How should he define the serverclasses and deployment-apps configuration? Does he need to prepare many Stream TAs with different streamfwd.xml in deployment-app folder and have many serverclasses for each?

Any idea would be very appreciated.
Thank you.

[esix_splunk]

You have the correct idea for deployment server. He will need a distinct server class for each distinct instance type. Then push the configurations from the deployment server to those instances. That should work, have done it on smaller deployments.