Deployment Architecture

How to edit the configuration for my Search Head to act as a Deployment Server?

nce054
Path Finder

I am trying to configure my Search Head to act as a Deployment Server for my Universal Forwarders. On the forwarders, I have put the following in $SPLUNK_HOME\etc\system\local\deploymentclient.conf :

 [deployment-client]
    clientName = Evan-Test
  [target-broker:deploymentServer]
    targetUri= host:port

Where host:port is my Search Head. What do I need to change on the Search Head for it to start acting as a Deployment Server? I go to Settings->Server Settings->Deployment Client, and I see no clients hooked up to my Search Head/Deployment Server.

0 Karma
1 Solution

woodcock
Esteemed Legend

The simplest way is to use the GUI and go to Settings -> Forwarder Management -> Server Classes -> Create One.

View solution in original post

0 Karma

woodcock
Esteemed Legend

The simplest way is to use the GUI and go to Settings -> Forwarder Management -> Server Classes -> Create One.

0 Karma

nce054
Path Finder

Thank you!

0 Karma

woodcock
Esteemed Legend

The serverclass lets you specify whitelist and blacklist for incoming connections. Without one of these set, your Search Head is not a DS.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...