Deployment Architecture

Possible to control which attribute matching is performed on in serverclass?

dstaulcu
Builder

The other day I noticed a subset of workstation based deployment clients had an app installed that was meant only for servers.

It turns out the workstations received the server oriented app because of a whitelist entry match on the InstanceID (guid) attribute.  The whitelist pattern was constructed with matching on clientName or hostname attributes in mind.  I was able to work around the problem by making the whitelist entry regular expression less ambiguous.

This got me wondering whether there is a way to control which attribute matching is conducted on for a given whitelist entry.   I see  for CSV based whitelist entries there are all manner of new features which enable specification of the attribute on which  matching occurs (field name).  Is the same sort of control possible through non CSV based whitelist entries?

 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @dstaulcu,

Unfortunately, non CSV whitelists are match on following order,

* The value of this attribute is matched against several things in order:
    * Any clientName specified by the client in its deploymentclient.conf file
    * The IP address of the connected client
    * The hostname of the connected client, as provided by reverse DNS lookup
    * The hostname of the client, as provided by the client
    * For Splunk Enterprise version > 6.4, the instanceId of the client. This is
      a GUID string, for example: 'ffe9fe01-a4fb-425e-9f63-56cc274d7f8b'.

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

dstaulcu
Builder

thanks for the input.   i had already checked the spec but was hoping someone was aware of a creative workaround.  

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @dstaulcu,

Unfortunately, non CSV whitelists are match on following order,

* The value of this attribute is matched against several things in order:
    * Any clientName specified by the client in its deploymentclient.conf file
    * The IP address of the connected client
    * The hostname of the connected client, as provided by reverse DNS lookup
    * The hostname of the client, as provided by the client
    * For Splunk Enterprise version > 6.4, the instanceId of the client. This is
      a GUID string, for example: 'ffe9fe01-a4fb-425e-9f63-56cc274d7f8b'.

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...