Dashboards & Visualizations

Is default deploymentclient.conf under $SPLUNK_HOME/etc/system/default?

bheemireddi
Communicator

I might be missing something here.. I know all the default configs available under $SPLUNK_HOME/etc/system/default, but I don't find deploymentclient.conf there . I see the .spec file but not the actual one. Is it normal? just wondering how Splunk is setting the defaults(like phoneHomeIntervalInSecs) with out having this file? it just works by design?

Thanks,

0 Karma

joechakkola1
Explorer

you can point universal forwarder (ay host is UF1) to deployment server ( say host is DS1) in couple of ways .

option 1) using the command splunk set deploy-poll on UF1
example : ./splunk set deploy-poll DS1:8089
this will create a deploymentclient.conf under etc/system/local. within this file you can set the paramters that you mentioned earlier ( phoneHomeIntervalInSecs)

option 2) you can create an app ( or push it from the deployment server) and place it under UF1 .
deploymentclient.conf should be part of your app , example : /etc/apps//local/deploymentclient.conf

on a UF1 you can check to see which deployment server your UF is pointing to by running the below command.
./splunk show deploy-poll

0 Karma

bheemireddi
Communicator

Hi,

Yes I am aware that we need to configure the deployment client through either CLI or the deploymentclient.conf. Documentation says the default phoneHomeIntervalInSecs is 60Sec. So I was just referring where it was set.

Thank you for all your replies.

Raji.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

In this case, the default value is probably set in the code, not in a .conf file.

ChrisG
Splunk Employee
Splunk Employee

bmunson is correct, there is no default deploymentclient.conf. See Configure deployment clients in the documentation, which explains how to configure from the CLI or how to create and and edit a local deploymentclient.conf file.

0 Karma

bmunson_splunk
Splunk Employee
Splunk Employee

There is no default deploymentclient.conf.

martin_mueller
SplunkTrust
SplunkTrust

Interestingly, running this

./bin/splunk cmd btool deploymentclient list --debug

doesn't show any default settings.

0 Karma

kearaspoor
SplunkTrust
SplunkTrust

Thank you all for this thread!   I've been working on Splunk for close to 10 years and JUST ran into this today for the first time and thought I was losing my mind because I can't find any record of etc/system/default/deploymentclient.conf on any of my systems.     Thank you for confirming that I'm not the only one thinking this is really, really weird but seems "normal"

 

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...