Deployment Architecture

Can multiple serverclasses reference the same app in serverclass.conf?

Path Finder

I'm still trying to address the need from Groups of hosts for serverclass.conf? and I think I see an ugly hack, and I want to know if it'll break anything.

Can two serverclasses in serverclass.conf reference the same app? E.g., if I have an app defined in the /opt/splunk/etc/deployment-apps/MyApp/ tree, can I have


as well as


That way, if I have sets of servers for Alpha, Bravo, and Charlie, and log apps of MyAppOne and MyAppTwo, I can mix and match without having to repeat the complex whitelist/blacklist filters. In other words, if AlphaClass is going to need MyAppOne and MyAppTwo, I only specify the hosts via whitelist/blacklist once for AlphaClass and then have AlphaClass be the serverclass for both apps, and the app stanza just needs whitelist.0=* to equal the "group" of servers I specified in the class.

Does that work or is there some subtlety of the way classes and apps interact that won't allow this sort of modular reuse?

Tags (2)
0 Karma

Ultra Champion

The following would work as expected 🙂

whitelist.0 =
whitelist.1 =

whitelist.0 =
whitelist.1 =

whitelist.0 =
whitelist.1 =


Alpha gets both apps, Bravo gets MyAppOne, Charlie gets MyAppTwo. No need to further specify whitelists/blacklists on the [serverClass:X:app:Y]-level.

In fact if you add a blacklist.0 = for [serverClass:Aplpha:app:MyAppOne], I think you have to explicitly re-add a whitelist.0 = on the app-level stanza, if I understood the documentation correctly.

Simple as that.


0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...