Deployment Architecture

Splunk Deployment Servers

rcavallo
New Member

Folks, while the documentation for things splunklike are usually very good, it is very poor when it comes to using the deployment server feature.

What I am looking for is some help with setting up some serverclasses based upon what types of applications are installed on those servers, and I don't want to deploy applications I want to deploy configurations.

So lets say I designate one server, deploymentserver as my, you guessed it, Deployment Server. I place in splunk_home$/etc/system/local a serverclass.conf. I put a congiguration that says for all deployment clients that have alfresco, please monitor /apps/alfresco/log/alfresco.log.

Can someone provide a very simple, one dimensional example of the above for serverclass.conf? I understand there are many other nuances to it.

Then, on my server that I want to deploy this configuration to, I indicate that I am an alfresco server.

Can someone provide a very simple, one dimensional example of the above as well for my SPLUNK_HOME/etc/system/local/deploymentclient.conf file? How do I indicate in this file "I am an alfresco server"?

I will have servers that have multiple applications on them be part of multiple serverclass indicators, and indicate each application in the deplomentclient.conf

Hope someone can help here. Thanks!!

Tags (1)
0 Karma

woodcock
Esteemed Legend

First you create an app called alfresco that contains at least inputs.conf and put it here:

$SPLUNK_HOME/etc/deployment-apps/alfresco/

Then you put something like the following into serverclass.conf:

[serverClass:alfresco)forwarder]
whitelist.0 = <alfresco_server1_hostname>
whitelist.1 = <alfresco_server2_hostname>

[serverClass:alfresco_forwarder:app:alfresco]
restartSplunkd = true
stateOnClient = enabled

See more here:
http://docs.splunk.com/Documentation/Splunk/latest/Updating/Useforwardermanagement

0 Karma

woodcock
Esteemed Legend

Did you get this working?

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...