Deployment Architecture

Filter deployment by machineType not working?

dave_duvall
Explorer

Anyone having good luck using machineType to filter clients in the deployment manager? Here is a snippet of my serverclass.conf

#Server Class for Windows
[serverClass:windows]
machineTypes=windows-intel,windows-x64

[serverClass:windows:app:winevt]
stateOnClient=enabled
restartSplunkd=true

My app is called winevt and enables basic windows event collection. The problem is - Linux forwarders are picking up this configuration. Everything is 4.0.11 in this world right now.

Anyone else experience this or am I misunderstanding the docs - it seemed like you didn't need a whitelist/blacklist if you were filtering the class by machineType.

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

machineTypes only takes effect if the machine has failed the whitelist/blacklist filters. The easiest way to make it work is to add:

[global]
blacklist.0=*

to the top of your serverclass.conf file.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

machineTypes only takes effect if the machine has failed the whitelist/blacklist filters. The easiest way to make it work is to add:

[global]
blacklist.0=*

to the top of your serverclass.conf file.

dave_duvall
Explorer

Thanks - that was the trick...

0 Karma

piebob
Splunk Employee
Splunk Employee

cool, i'll make sure this gets updated in the deployment server doc.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...