Deployment Architecture

How to define clients for a server class based on installed Windows feature?

paulcurry
Path Finder

I have a use case where about 50% of my windows clients have IIS running on them.  I'd like to have a server class just for those 50% to ingest IIS logs.  I have IIS logs coming in but I have to manually list each client in the whitelist.  Is there a way to determine if a server has IIS, then deploy a specific server class?  I was thinking by an installed Windows Feature perhaps?  I'm at a loss.

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

In that case, yes, I think you'd have to manually specify host names for 3 separate server classes.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Deployment servers are rather limited in how they can filter forwarders into classes.  Consider deploying the IIS input to all Windows servers.  Those servers without IIS installed will ignore the absent file(s).

---
If this reply helps you, Karma would be appreciated.

paulcurry
Path Finder

That's probably the best plan.  However, say I have 15 normal IIS servers, 5 SFTP servers, and 5 SSRS servers.  All 25 run on IIS so the app the server class pushes out will go to one index.  But all 3 log types parse differently from an identical location.  This sounds like I would have to manually specify hosts for separate classes, right?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

In that case, yes, I think you'd have to manually specify host names for 3 separate server classes.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...