Deployment Architecture

Deploying an app causes splunkweb.exe on deploy client to switch on. How to stop this?

Ant1D
Motivator

Hey,

Whenever I deploy application App_1 across my Indexers, the application deploys successfully however the splunkweb.exe service on each of these servers is switched back on. As these servers are used for indexing only, the splunkweb.exe service does not need to run on these servers.

Is there an attribute in my config below (taken from serverclass.conf) that can be used to prevent the splunkweb.exe service from starting each time a deployment is executed? restartSplunkWeb=false does not seem to achieve this.

[serverClass:All-Configs]
whitelist.0 = Indexer*

[serverClass:All-Configs:app:App_1]
stateOnClient=enabled
restartSplunkd=true
restartSplunkWeb=false

Thanks in advance for your help.

0 Karma
1 Solution

Ayn
Legend

splunkweb is turned off by setting the following in web.conf:

[settings]
startwebserver = 0

View solution in original post

0 Karma

Ayn
Legend

splunkweb is turned off by setting the following in web.conf:

[settings]
startwebserver = 0
0 Karma

Ant1D
Motivator

Hi Ayn, if I add this to web.conf and then try to run splunk restart splunkweb or splunk start splunkweb in the CLI will these commands turn splunkweb on OR will this setting in web.conf override any attempts to turn on splunkweb? Thanks

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...