I might be missing something here.. I know all the default configs available under $SPLUNK_HOME/etc/system/default, but I don't find deploymentclient.conf there . I see the .spec file but not the actual one. Is it normal? just wondering how Splunk is setting the defaults(like phoneHomeIntervalInSecs) with out having this file? it just works by design?
you can point universal forwarder (ay host is UF1) to deployment server ( say host is DS1) in couple of ways .
option 1) using the command splunk set deploy-poll on UF1
example : ./splunk set deploy-poll DS1:8089
this will create a deploymentclient.conf under etc/system/local. within this file you can set the paramters that you mentioned earlier ( phoneHomeIntervalInSecs)
option 2) you can create an app ( or push it from the deployment server) and place it under UF1 .
deploymentclient.conf should be part of your app , example : /etc/apps//local/deploymentclient.conf
on a UF1 you can check to see which deployment server your UF is pointing to by running the below command.
./splunk show deploy-poll
Yes I am aware that we need to configure the deployment client through either CLI or the deploymentclient.conf. Documentation says the default phoneHomeIntervalInSecs is 60Sec. So I was just referring where it was set.
Thank you for all your replies.
bmunson is correct, there is no default deploymentclient.conf. See Configure deployment clients in the documentation, which explains how to configure from the CLI or how to create and and edit a local deploymentclient.conf file.