Let's say I have a large network of computers with universal forwarders installed on them.
Let's also say that they will all run the same app on their universal forwarders.
Let's additionally say I have a deployment server.
Will a deployment server by default deploy any apps installed in $SPLUNK_HOME/etc/deployment-apps?
For example, if I configure the universal forwarders to all point to the deployment server, and then configure and place my app into $SPLUNK_HOME/etc/deployment-apps on my deployment server, must I also edit serverclass.conf before the deployment server will begin to deploy apps to the universal forwarders?
Yes, that is where you specify WHICH deployment-client (i.e. forwarder) should get WHICH app.
That being said, if your
serverclass.conf has stanzas like this;
[serverClass:blah] whitelist.0=* [serverClass:blah:app:foo]
you do not need to edit
serverclass.conf if you've edited the contents of the foo-app. But you will need to reload the deployment server configuration in order for the DS to realize that the foo app has changed.
$SPLUNK_HOME/bin/splunk reload deploy-server
If you only have one app to be delivered to your hundreds of (all) forwarders
- and you have already configured the
deploymentclient.conf on all of them.
- and you have already created your app,
- and put it into $SPLUNK_HOME/etc/deployment-apps on your DS.
Congrats! You've done all the hard stuff. How hard is it to just inform your splunk server that it should also act as a DS, by creating a serverclass.conf $SPLUNK_HOME/etc/system/local and restarting.
No serverclass.conf. No DS. There is no default.
Hope this helps,
So even if I have:
you're saying I still need to edit serverclass.conf to include at least the [global] stanza and
It would seem to me that, with the defaults, I should not have to make changes to serverclass.conf in this specific scenario where I have one app, all clients should get that app, and the app is on the deployment server.
Appreciate the guidance on this.