Serverclass using machineTypes that excludes one server

[imacdonald2]

I would like to have a serverclass for all linux machines that excludes one machine.

I have tried the following but it doesn't appear to work, the app fwd_to_splunk still gets deployed to the server.

Any suggestions.

[global]

blacklist.0=*

[serverClass:alllinux]

machineTypes=linux-*

blacklist.0=host1

[serverClass:alllinux:app:fwd_to_splunk]

stateOnClient=enabled

restartSplunkd=true

[gavin1_davenpor]

Quote: "I expect there to be a change in the 4.3 release of Splunk due very imminently to provide the functionality you're looking for. (And which is useful to most people.)"

I'd like to be able to include all my hosts by machineType but then EXCLUDE a static list of hosts by name - i.e. to be able to use 2 serverclass definitions for the same app.
Define serverclass A based on machineType
Define serverclass B based on hostname/IP
Whitelist by machineType serverclass A
then Blacklist by hostname serverclass B

Did this get incorporated in 4.3.* ?

[gavin1_davenpor]

So I can do:
[serverClass:mynewapp]
machineTypesFilter=linux-x86_64
blacklist.0=dont_push_new_app_to_me1.fqdn
blacklist.1=dont_push_new_app_to_me2.fqdn

This would push "mynewapp" to all x86_64 linux hosts EXCEPT the 2 blacklisted ?

[gkanapathy]

You are also misunderstanding how serverclasses and filters should work. the functionality in 4.3 has nothing to do with working across different serverclasses, only on rules within a serverclass (or app).

[gkanapathy]

see machineTypeFilter setting and compare with machineTypes setting

[gavin1_davenpor]

That didn't answer my question.
I would like to be able to - for a given serverclass -
whitelist based on machineTypesFilter and ALSO blacklist based on hostname.

Your comment from 04/01 suggested you expected this change to be incorporated in the 4.3 version. Did it get incorporated ?

My solution has been to have apps I consider 'stable' to be covered by machineTypesFilter, and apps I consider in development to be covered by whitelists.

[gkanapathy]

see machineTypesFilter setting.

[gkanapathy · Accepted solution]

Unfortunately, you can't do this. The logic of machineTypes is such that every machine that is blacklisted (or not whitelisted) is checked for the machineType, and then is sent that serverclass/app. (The logic is "matching names OR matching machineTypes", instead of your desired "matching names AND matching machineTypes") This functionality is not useful behavior, and is basically a design flaw.

I expect there to be a change in the 4.3 release of Splunk due very imminently to provide the functionality you're looking for. (And which is useful to most people.)

[gkanapathy]

yes, if it's going to all machines (even if they're not linux), then you can just drop the machineTypes clause, and use white/black lists only.

[imacdonald2]

so it sounds like I can't do this using machineTypes, any thoughts on an other way I can do this? I guess I could do a whitelist.0=0 then blacklist.0=host1, and apply it to all machines. Since the forwarder config is the same for windows and linux

[Kate_Lawrence-G]

I'd try something like this:

[global]
[serverClass:AppsByMachineType]
whitelist.0 = *

[serverClass:AppsByMachineType:app:linux-base]
# Deploy this app only to unix boxes - 32/64 bit.
machineTypes = linux-i686, linux-x86_64
restartSplunkd = true
stateOnClient = enabled
blacklist.0 = host1

[gkanapathy]

As I said in my other answer.

[imacdonald2]

I tried this and it didn't work it still goes out to host1. Do you have this working?