I am working in a development environment.
One indexer/search head (DeploymentServer)
One forwarder (DeploymentClient)
I am trying to get my forwarder to install the *nix app and update it's inputs.conf.
[global] whitelist.0=* restartSplunkd=True stateOnClient=enabled [serverClass:lcfapp-d:app:unix] machineTypes=linux-x86_64 stateOnClient=enabled restartSplunkd=True [serverClass:lcfapp-d:app:lcfapp-d] stateOnClient=enabled
[lcfapp-d] [target-broker:deploymentServer] targetUri= 192.168.XXX.XXX:8089 (the X's are numbers)
I have restarted splunk on both machines several times.
Am I missing something?
[global] whitelist.0 = * [serverClass:lcfapp-d:app:unix] stateOnClient=enabled restartSplunkd=True [serverClass:lcfapp-d:app:lcfapp-d] stateOnClient=enabled restartSplunkd=true [serverClass:lcfapp-d] machineTypes=linux-x86_64
And just to clarify, the main issue here is that you hadn't defined the "lcfapp-d" serverclass. The stanzas containing the ":app:" parts are explicitly for defining which apps should go to which serverclasses, so those serverclasses need to be defined on their own for that to work.
I am half way there. The unix app was installed.
The /opt/splunkforwarder/etc/system/local/inputs.conf was not updated.
It did create a /opt/splunkforwarder/etc/apps/lcfapp-d/local/inputs.conf file.
etc/system is not under the deployment server's control. The only thing the deployment server does is it pushes apps from its deployment-apps directory to deployment clients' apps directory (according to the rules set in serverclass.conf), so no other directories will have their contents modified.