Deployment Architecture

Filter deployment by machineType not working?

dave_duvall
Explorer

Anyone having good luck using machineType to filter clients in the deployment manager? Here is a snippet of my serverclass.conf

#Server Class for Windows
[serverClass:windows]
machineTypes=windows-intel,windows-x64

[serverClass:windows:app:winevt]
stateOnClient=enabled
restartSplunkd=true

My app is called winevt and enables basic windows event collection. The problem is - Linux forwarders are picking up this configuration. Everything is 4.0.11 in this world right now.

Anyone else experience this or am I misunderstanding the docs - it seemed like you didn't need a whitelist/blacklist if you were filtering the class by machineType.

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

machineTypes only takes effect if the machine has failed the whitelist/blacklist filters. The easiest way to make it work is to add:

[global]
blacklist.0=*

to the top of your serverclass.conf file.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

machineTypes only takes effect if the machine has failed the whitelist/blacklist filters. The easiest way to make it work is to add:

[global]
blacklist.0=*

to the top of your serverclass.conf file.

dave_duvall
Explorer

Thanks - that was the trick...

0 Karma

piebob
Splunk Employee
Splunk Employee

cool, i'll make sure this gets updated in the deployment server doc.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...