Deployment Architecture

Problem of building deployment server ?

sieutruc
Contributor

Hello,

When i configure serverclass.conf (Windows based) , i got an error below:

targetRepositoryLocation=$SPLUNK_HOME\etc\apps [error of typos]
I don't know why although trying another case $SPLUNK_HOME/etc/apps

Second, when i have already installed UF and made it get apps from one deployment server. Is it possible to modify its inputs.conf in system/local so that some properies dont follow its deployment server's configuration ?

Third, how to use clientName ? i specified clientName for one UF to test01, and made whitelist.0=test* in serverclass.conf. But after restart deployment server and UF. The indexer (same place as deploymnet server) cannot recognize and no data being received. Do you have an example of using clientName ?

Tags (1)
1 Solution

dart
Splunk Employee
Splunk Employee

Hi,

Can you post the full error?

You can override any property for any stanza by adding the stanza and properties you want to override in the system/local/inputs.conf. system/local has the highest precedence.

Can you post the full configuration from the client and the deployment server for your last query?

Thanks!

View solution in original post

dart
Splunk Employee
Splunk Employee

Hi,

Can you post the full error?

You can override any property for any stanza by adding the stanza and properties you want to override in the system/local/inputs.conf. system/local has the highest precedence.

Can you post the full configuration from the client and the deployment server for your last query?

Thanks!

sieutruc
Contributor

Yes, it's here: serverclass.conf
[global]
whitelist.0=*

[serverClass:clientManage]
repositoryLocation=$SPLUNK_HOME/etc/deployment-apps
filterType = blacklist
repositoryLocation = C:\Program Files\Splunk\etc\deployment-apps
whitelist.0 = client*

[serverClass:clientManage:app:inputTest]
repositoryLocation=$SPLUNK_HOME/etc/deployment-apps
stateOnClient=enabled
restartSplunkd=true

Iam in Windows based machine, and i have already set SPLUNK_HOME in system variable. but i dont know why i got the typos of that line containing "repositoryLocation". Can you suggest me a correct path ?

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...