Is default deploymentclient.conf under $SPLUNK_HOME/etc/system/default?

[bheemireddi]

I might be missing something here.. I know all the default configs available under $SPLUNK_HOME/etc/system/default, but I don't find deploymentclient.conf there . I see the .spec file but not the actual one. Is it normal? just wondering how Splunk is setting the defaults(like phoneHomeIntervalInSecs) with out having this file? it just works by design?

Thanks,

[joechakkola1]

you can point universal forwarder (ay host is UF1) to deployment server ( say host is DS1) in couple of ways .

option 1) using the command splunk set deploy-poll on UF1
example : ./splunk set deploy-poll DS1:8089
this will create a deploymentclient.conf under etc/system/local. within this file you can set the paramters that you mentioned earlier ( phoneHomeIntervalInSecs)

option 2) you can create an app ( or push it from the deployment server) and place it under UF1 .
deploymentclient.conf should be part of your app , example : /etc/apps//local/deploymentclient.conf

on a UF1 you can check to see which deployment server your UF is pointing to by running the below command.
./splunk show deploy-poll

[bheemireddi]

Hi,

Yes I am aware that we need to configure the deployment client through either CLI or the deploymentclient.conf. Documentation says the default phoneHomeIntervalInSecs is 60Sec. So I was just referring where it was set.

Thank you for all your replies.

Raji.

[ChrisG]

In this case, the default value is probably set in the code, not in a .conf file.

[ChrisG]

bmunson is correct, there is no default deploymentclient.conf. See Configure deployment clients in the documentation, which explains how to configure from the CLI or how to create and and edit a local deploymentclient.conf file.

[bmunson_splunk]

There is no default deploymentclient.conf.

[martin_mueller]

Interestingly, running this

./bin/splunk cmd btool deploymentclient list --debug

doesn't show any default settings.

[kearaspoor]

Thank you all for this thread!   I've been working on Splunk for close to 10 years and JUST ran into this today for the first time and thought I was losing my mind because I can't find any record of etc/system/default/deploymentclient.conf on any of my systems.     Thank you for confirming that I'm not the only one thinking this is really, really weird but seems "normal"