Deployment Architecture

Per-app machineTypesFilter broken in serverclass.conf

marksnelling
Communicator

I have a server class defined in serverclass.conf and I want to install a different app based on the machineTypesFilter.

[global]
repositoryLocation = $SPLUNK_HOME/etc/deployment-apps
targetRepositoryLocation = $SPLUNK_HOME/etc/apps
stateOnClient = enabled
restartSplunkd = true
whitelist.0 = *

[serverClass:SomeClass]
whitelist.0 = *
[serverClass:SomeClass:app:WindowsApp]
machineTypesFilter = windows-x64
[serverClass:SomeClass:app:LinuxApp]
machineTypesFilter = linux-x86_64

However the machineTypesFilter seems to be broken and no apps are deployed.

This is basically a copy of Example 3 in the serverclass.conf documentation.

1 Solution

ctux
Path Finder

Use whitelist in AND at app level too...


[serverClass:SomeClass]
whitelist.0 = *

[serverClass:SomeClass:app:WindowsApp]
whitelist.0 = *
machineTypesFilter = windows-x64

[serverClass:SomeClass:app:LinuxApp]
whitelist.0 = *
machineTypesFilter = linux-x86_64

View solution in original post

ctux
Path Finder

Use whitelist in AND at app level too...


[serverClass:SomeClass]
whitelist.0 = *

[serverClass:SomeClass:app:WindowsApp]
whitelist.0 = *
machineTypesFilter = windows-x64

[serverClass:SomeClass:app:LinuxApp]
whitelist.0 = *
machineTypesFilter = linux-x86_64

malmoore
Splunk Employee
Splunk Employee

Not if you add a 'blacklist' entry that contains the machines you don't want the app deployed on to the global stanza. Remember, filterType as whitelist means blacklisted items get excluded unconditionally.

0 Karma

msarro
Builder

This does not work if you need a global blacklist, because the whitelist.0=* line will then deploy the app to all servers so long as they match the machineFilterType.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...