Deployment Server question

[beaunewcomb]

Can someone verify that this kind of deployment would work?

I'm deploying Splunk in a small environment of around 10 servers. Rather than manage Splunk on each one I want to use deployment server. The environment is made up of 3 different smaller environments (Dev, QA, Prod), with 3 classes of servers within each (Web, Batch, DB). Server naming convention example is: Dev-Web-1a1 (1a1 is a location code)

What I want to do is plan my serverclass.conf so I can say ALL DEV servers get this app. ALL DEV WEB servers get all of the above + these web-specific apps.

Given the naming convention and deployment model would the approach below work? Would there be any conflict with nesting groups based on hostname like this? Also, does deployment server go by the name set in server.conf? These servers are actually using random hostnames, but I want to inject a friendly name in server.conf.

######################
# QA  Environment  #
######################
[serverClass:QA]
restartSplunkd = true
whitelist.0 = *qa*

############
# QA-Web #
############
[serverClass:QAWeb]
restartSplunkd = true
whitelist.0 = *qa-web*

[starcher · Accepted solution]

When matching hostname it is going to match based on the name sent by the forwarder. The forwarder runs a hostname command like you would do at a command line and reports that as the value. You can put hosts in multiple classes and it will pull "apps" you assign those groups and use the normal splunk order of precedence for applying configurations. I often do a splunk list deploy-clients and see how the hostnames are coming in before making decisions on assigning them by name vs ip in the serverclass.conf