Deployment Architecture

How to define clients for a server class based on installed Windows feature?

paulcurry
Path Finder

I have a use case where about 50% of my windows clients have IIS running on them.  I'd like to have a server class just for those 50% to ingest IIS logs.  I have IIS logs coming in but I have to manually list each client in the whitelist.  Is there a way to determine if a server has IIS, then deploy a specific server class?  I was thinking by an installed Windows Feature perhaps?  I'm at a loss.

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

In that case, yes, I think you'd have to manually specify host names for 3 separate server classes.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Deployment servers are rather limited in how they can filter forwarders into classes.  Consider deploying the IIS input to all Windows servers.  Those servers without IIS installed will ignore the absent file(s).

---
If this reply helps you, Karma would be appreciated.

paulcurry
Path Finder

That's probably the best plan.  However, say I have 15 normal IIS servers, 5 SFTP servers, and 5 SSRS servers.  All 25 run on IIS so the app the server class pushes out will go to one index.  But all 3 log types parse differently from an identical location.  This sounds like I would have to manually specify hosts for separate classes, right?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

In that case, yes, I think you'd have to manually specify host names for 3 separate server classes.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...