Setting phoneHomeIntervalInSecs

[pfabrizi]

I need to set this for my Windows deployment clients only. Can I add this entry to the WEB.CONF or can I only add this to the DEPLOYMENTCLIENT.CONF?

If so how does it have the same impact on my HF, INDEX?

I want my Windows UF client to on poll every 6 hours instead of a minute since I will have 12,000.

Thanks!

[micahkemp · Accepted solution]

You do make this configuration change in deploymentclient.conf on the forwarder itself, or for extra credit you can/should configure different classes of servers as necessary by having the deployment server itself push an updated deploymentclient.conf with the most appropriate setting per class.

[pfabrizi]

so if I have a windows server class, a Indexer class and a HF class and I want this setting to only apply to my windows server class how would I setup the stanza in the deploymentclient.conf on the deployment server ?

[micahkemp]

Refer to the Splunk documentation for specifics, but the general idea is you would create an app in deployment-apps on the deployment server, say, windows_forwarder_phonehome, that contains deploymentclient.conf.

Then you create a server class that defines which hosts you want to configure (in this case probably a filter for all windows hosts), and add this app to the serverclass.

Further explanation without specific questions is getting a bit too close to "teach me to use a deployment server", but hopefully the above gives you an idea of what you're looking for.

[pfabrizi]

Thanks, That helped.

[brad_thomas]

My understanding from the documentation is that this setting needs to be made in deploymentclient.conf for each UF.

[mayurr98]

Hey

Have a look at this answer to set the optimum phonehome interval
https://answers.splunk.com/answers/99430/when-managing-large-numbers-of-deployment-clients-1000-what...
You need to do entry in deployment.conf

Let me know if this helps!