Deployment Architecture

How to manage deployment clients?

hulahoop
Splunk Employee
Splunk Employee

In Splunk documentation, the communication model between deployment server and clients is described as

The deployment client periodically polls the deployment server, identifying itself.

How often does this polling occur? What if clients fail to check in? How do I identify clients which have not polled the deployment server? Is there an App for this?

1 Solution

Joffer
Path Finder

You can use splunk list deploy-clients to list the clients that have contacted the server.

The phone home interval is 30 seconds by default. It can be changed in $SPLUNK_HOME/etc/system/local/deploymentclient.conf by setting/changing the phoneHomeIntervalInSecs variable. My example below changes this to 1 minute (60 seconds)

#***************************************************************************
# Configure a Splunk deployment client.
# 
# Note: At a minimum the [deployment-client] stanza is required in
# deploymentclient.conf for deployment client to be enabled.
#***************************************************************************
[deployment-client]
disabled = false
serverEndpointPolicy = acceptAlways
phoneHomeIntervalInSecs = 60

#***************************************************************************
# The following stanza specifies deployment server connection information
#***************************************************************************
[target-broker:deploymentServer]
targetUri = splunk01.mydomain.loc:8089

View solution in original post

Joffer
Path Finder

You can use splunk list deploy-clients to list the clients that have contacted the server.

The phone home interval is 30 seconds by default. It can be changed in $SPLUNK_HOME/etc/system/local/deploymentclient.conf by setting/changing the phoneHomeIntervalInSecs variable. My example below changes this to 1 minute (60 seconds)

#***************************************************************************
# Configure a Splunk deployment client.
# 
# Note: At a minimum the [deployment-client] stanza is required in
# deploymentclient.conf for deployment client to be enabled.
#***************************************************************************
[deployment-client]
disabled = false
serverEndpointPolicy = acceptAlways
phoneHomeIntervalInSecs = 60

#***************************************************************************
# The following stanza specifies deployment server connection information
#***************************************************************************
[target-broker:deploymentServer]
targetUri = splunk01.mydomain.loc:8089

hulahoop
Splunk Employee
Splunk Employee

Awesome. Thank you, Joffer!

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...