Deployment Architecture

Filter deployment by machineType not working?

dave_duvall
Explorer

Anyone having good luck using machineType to filter clients in the deployment manager? Here is a snippet of my serverclass.conf

#Server Class for Windows
[serverClass:windows]
machineTypes=windows-intel,windows-x64

[serverClass:windows:app:winevt]
stateOnClient=enabled
restartSplunkd=true

My app is called winevt and enables basic windows event collection. The problem is - Linux forwarders are picking up this configuration. Everything is 4.0.11 in this world right now.

Anyone else experience this or am I misunderstanding the docs - it seemed like you didn't need a whitelist/blacklist if you were filtering the class by machineType.

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

machineTypes only takes effect if the machine has failed the whitelist/blacklist filters. The easiest way to make it work is to add:

[global]
blacklist.0=*

to the top of your serverclass.conf file.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

machineTypes only takes effect if the machine has failed the whitelist/blacklist filters. The easiest way to make it work is to add:

[global]
blacklist.0=*

to the top of your serverclass.conf file.

dave_duvall
Explorer

Thanks - that was the trick...

0 Karma

piebob
Splunk Employee
Splunk Employee

cool, i'll make sure this gets updated in the deployment server doc.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...