Deployment Architecture

How to edit the configuration for my Search Head to act as a Deployment Server?

nce054
Path Finder

I am trying to configure my Search Head to act as a Deployment Server for my Universal Forwarders. On the forwarders, I have put the following in $SPLUNK_HOME\etc\system\local\deploymentclient.conf :

 [deployment-client]
    clientName = Evan-Test
  [target-broker:deploymentServer]
    targetUri= host:port

Where host:port is my Search Head. What do I need to change on the Search Head for it to start acting as a Deployment Server? I go to Settings->Server Settings->Deployment Client, and I see no clients hooked up to my Search Head/Deployment Server.

0 Karma
1 Solution

woodcock
Esteemed Legend

The simplest way is to use the GUI and go to Settings -> Forwarder Management -> Server Classes -> Create One.

View solution in original post

0 Karma

woodcock
Esteemed Legend

The simplest way is to use the GUI and go to Settings -> Forwarder Management -> Server Classes -> Create One.

0 Karma

nce054
Path Finder

Thank you!

0 Karma

woodcock
Esteemed Legend

The serverclass lets you specify whitelist and blacklist for incoming connections. Without one of these set, your Search Head is not a DS.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...