All Apps and Add-ons

How to deploy the Splunk App for Stream to multiple universal forwarders with different monitoring settings via deployment server?

Splunk Employee
Splunk Employee

Dear experts,

My customer has 100 universal forwarders and each of the UFs are running the Splunk App for Stream. The problem is that each UF needs to have different settings for monitoring network interfaces. For example, in some UF, only eth8 and eth9 network interface should be monitored and the other network interfaces should be disabled. And another UF needs to monitor eth0 and eth1 only and the others should not be monitored.

He wants to handle the UFs with a deployment server. How should he define the serverclasses and deployment-apps configuration? Does he need to prepare many Stream TAs with different streamfwd.xml in deployment-app folder and have many serverclasses for each?

Any idea would be very appreciated.
Thank you.

0 Karma

Splunk Employee
Splunk Employee

You have the correct idea for deployment server. He will need a distinct server class for each distinct instance type. Then push the configurations from the deployment server to those instances. That should work, have done it on smaller deployments.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!