Can two serverclasses in serverclass.conf reference the same app? E.g., if I have an app defined in the /opt/splunk/etc/deployment-apps/MyApp/ tree, can I have
as well as
That way, if I have sets of servers for Alpha, Bravo, and Charlie, and log apps of MyAppOne and MyAppTwo, I can mix and match without having to repeat the complex whitelist/blacklist filters. In other words, if AlphaClass is going to need MyAppOne and MyAppTwo, I only specify the hosts via whitelist/blacklist once for AlphaClass and then have AlphaClass be the serverclass for both apps, and the app stanza just needs whitelist.0=* to equal the "group" of servers I specified in the class.
Does that work or is there some subtlety of the way classes and apps interact that won't allow this sort of modular reuse?
Alpha gets both apps, Bravo gets MyAppOne, Charlie gets MyAppTwo. No need to further specify whitelists/blacklists on the [serverClass:X:app:Y]-level.
In fact if you add a blacklist.0 = 10.1.1.1 for [serverClass:Aplpha:app:MyAppOne], I think you have to explicitly re-add a whitelist.0 = 10.2.2.2 on the app-level stanza, if I understood the documentation correctly.