I understand that you can determine which apps are in which serverclass through the Forwarder Management GUI. Is there any other way to look at which serverclass has which apps associated with it (through a search/a .conf file mapping the relationship?)
Server classes are saved in serverclass.conf. Check out the documentation: Use serverclass.conf to define server classes
You should find your server classes under etc/system/local/serverclass.conf
For testing purposes, I created the deployment app "testapp" along with the server class "testclass" through the Forwarder Management GUI. etc/system/local/serverclass.conf now contains the following
[serverClass:testclass:app:testapp]
restartSplunkWeb = 0
restartSplunkd = 0
stateOnClient = enabled
[serverClass:testclass]
whitelist.0 = 172.16.1.10
Server classes are saved in serverclass.conf. Check out the documentation: Use serverclass.conf to define server classes
You should find your server classes under etc/system/local/serverclass.conf
For testing purposes, I created the deployment app "testapp" along with the server class "testclass" through the Forwarder Management GUI. etc/system/local/serverclass.conf now contains the following
[serverClass:testclass:app:testapp]
restartSplunkWeb = 0
restartSplunkd = 0
stateOnClient = enabled
[serverClass:testclass]
whitelist.0 = 172.16.1.10
The serverclass.conf files I'm working with don't contain any app stanzas (only the whitelist sections). Is there anywhere else that serverclasses might be mapped to apps?
Make sure you are looking on your Deployment server and not the Search-head.
Check out your local app directories, e.g. etc/apps/myapp/local/serverclass.conf.
You can also use the Splunk REST API. Do the following Splunk search on your deployment server:
| rest /services/deployment/server/applications | table title,serverclasses
Couldn't find anything in the local app directories, but the search worked great. Thanks!