How to dynamically add servers to serverclass.conf Whitelist

[muthu285kumar]

we have ~16,000 windows client machines and the machines are reporting to a app
[serverClass:xom_TA-app1]
whitelist.0 = windows
machineTypesFilter = windows-intel,windows-x64

now we want to split ~1,500 point to app2 and the rest of 14,500 to point to app1

how can we achieve this without adding all the server names to whitelist as it will be very painful to manage?

[aaraneta_splunk]

@muthu285kumar - Did the answer provided by jplumsdaine22 help provide a solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

[jplumsdaine22 · Accepted solution]

Unfortunately the deployment server can only filter by os and hostname. If your environment has strict naming conventions (which is probably not the cas if you have that many hosts) you can use patterns in the whitelist filters, eg whitelist.0 = web[1-8] , but otherwise you will have to put each row in there manually. There's a few ways you can do it outside of Splunk, for example we generate the serverclass.conf via script by querying an LDAP directory and generating serverclasses based on OU membership.

However, for a large fleet of windows clients, I'm guessing you want to capture the windows event logs. If so, you might investigate using the Windows Event Collector service (an MS Server Role) to collect all the logs from the endpoints, and then have universal forwarders running on your WEC hosts.