anybody doing this on prem or preferably AWS?
How did you start? did you follow these steps below?
1: Stand Up a new Search Head to use as DS.
2: Put at least 1 app in $SPLUNK_HOME/etc/deployment-apps/
3: Create a serverclass.conf file on the DS (put your forwarder and app details in there).
4: Deploy a properly configured deploymentclient.conf file to at least 1 forwarder and restart splunk there.
Yes, and it is the ONLY configuration that I put in that directory. Everything else, including the
deploymentclient.conf should be inside of an app that YOU control in the
for example, i used to have serverclasses based on which systems needed inputs vs props, which systems needed indexes vs not, which systems needed forwarding vs not, which systems needed a WebUI enabled vs not, etc
is this config file automatically shown under /etc/ by default?
I wasn't sure about your last statement whether inputs vs props, what do you mean by props?
if your systems need indexes vs not, if they're not indexed then why do you have logs going into splunk?