Deployment Architecture

Setting phoneHomeIntervalInSecs

pfabrizi
Path Finder

I need to set this for my Windows deployment clients only. Can I add this entry to the WEB.CONF or can I only add this to the DEPLOYMENTCLIENT.CONF?

If so how does it have the same impact on my HF, INDEX?

I want my Windows UF client to on poll every 6 hours instead of a minute since I will have 12,000.

Thanks!

Tags (1)
0 Karma
1 Solution

micahkemp
Champion

You do make this configuration change in deploymentclient.conf on the forwarder itself, or for extra credit you can/should configure different classes of servers as necessary by having the deployment server itself push an updated deploymentclient.conf with the most appropriate setting per class.

View solution in original post

micahkemp
Champion

You do make this configuration change in deploymentclient.conf on the forwarder itself, or for extra credit you can/should configure different classes of servers as necessary by having the deployment server itself push an updated deploymentclient.conf with the most appropriate setting per class.

pfabrizi
Path Finder

so if I have a windows server class, a Indexer class and a HF class and I want this setting to only apply to my windows server class how would I setup the stanza in the deploymentclient.conf on the deployment server ?

0 Karma

micahkemp
Champion

Refer to the Splunk documentation for specifics, but the general idea is you would create an app in deployment-apps on the deployment server, say, windows_forwarder_phonehome, that contains deploymentclient.conf.

Then you create a server class that defines which hosts you want to configure (in this case probably a filter for all windows hosts), and add this app to the serverclass.

Further explanation without specific questions is getting a bit too close to "teach me to use a deployment server", but hopefully the above gives you an idea of what you're looking for.

pfabrizi
Path Finder

Thanks, That helped.

0 Karma

brad_thomas
Explorer

My understanding from the documentation is that this setting needs to be made in deploymentclient.conf for each UF.

0 Karma

mayurr98
Super Champion

Hey

Have a look at this answer to set the optimum phonehome interval
https://answers.splunk.com/answers/99430/when-managing-large-numbers-of-deployment-clients-1000-what...
You need to do entry in deployment.conf

Let me know if this helps!

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...