Deployment Architecture

Can multiple serverclasses reference the same app in serverclass.conf?

Path Finder

I'm still trying to address the need from Groups of hosts for serverclass.conf? and I think I see an ugly hack, and I want to know if it'll break anything.

Can two serverclasses in serverclass.conf reference the same app? E.g., if I have an app defined in the /opt/splunk/etc/deployment-apps/MyApp/ tree, can I have


as well as


That way, if I have sets of servers for Alpha, Bravo, and Charlie, and log apps of MyAppOne and MyAppTwo, I can mix and match without having to repeat the complex whitelist/blacklist filters. In other words, if AlphaClass is going to need MyAppOne and MyAppTwo, I only specify the hosts via whitelist/blacklist once for AlphaClass and then have AlphaClass be the serverclass for both apps, and the app stanza just needs whitelist.0=* to equal the "group" of servers I specified in the class.

Does that work or is there some subtlety of the way classes and apps interact that won't allow this sort of modular reuse?

Tags (2)
0 Karma

Ultra Champion

The following would work as expected 🙂

whitelist.0 =
whitelist.1 =

whitelist.0 =
whitelist.1 =

whitelist.0 =
whitelist.1 =


Alpha gets both apps, Bravo gets MyAppOne, Charlie gets MyAppTwo. No need to further specify whitelists/blacklists on the [serverClass:X:app:Y]-level.

In fact if you add a blacklist.0 = for [serverClass:Aplpha:app:MyAppOne], I think you have to explicitly re-add a whitelist.0 = on the app-level stanza, if I understood the documentation correctly.

Simple as that.


0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!