Using packageTypesFilter in serverclass.conf

[lar06]

Hello

Using Splunk 9.3.2

I want to deploy an app to all Windows UF only. 

This config doesn't work. 

[serverClass:scallufwin:app:btoolufwin]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled

[serverClass:scallufwin]
machineTypesFilter = windows-x64
packageTypesFilter = universal_forwarder 
whitelist.0 = srv*

Moving the packageTypesFilter parameter to the serverClass:app stanza fixed the issue.

[serverClass:scallufwin:app:btoolufwin]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
packageTypesFilter = universal_forwarder

[serverClass:scallufwin]
machineTypesFilter = windows-x64
whitelist.0 = srv*

Does that mean packageTypesFilter and machineTypesFilter can't be used in the same stanza ?

Thanks

[lar06]

Yes, I'm expecting the whitelist to be applied on both machineTypesFilter AND packageTypesFilter. Therefore, I'm expecting to have only clients with name=srv* AND OS=windows-x64 AND package=universal_forwarder.

This is not working with whitelist AND machineType AND packageType in the same stanza.
The doc doesn't tell if both TypesFilter parameters can be used in the same stanza.

[livehybrid]

Hi @lar06 

The packageTypesFilter key uses the logic in the whitelist/blacklist as well as machineTypesFilter, therefore the whitelist you have specified is trying to be applied to both your machineTypesFilter AND packageTypesFilter.

packageTypesFilter = <comma-separated list>
* Optional.
* Boolean OR logic is employed: a match against any element in the list
  constitutes a match.
* This filter is used in boolean AND logic with 'whitelist'/'blacklist'
  filters. Only clients which match the 'whitelist'/'blacklist' AND which
  match this packageTypesFilter are included.
  * In other words, the match is an intersection of the matches for the
    'whitelist'/'blacklist' and the matches for 'packageTypesFilter'.

For more information have a look at https://docs.splunk.com/Documentation/Splunk/9.4.1/Admin/Serverclassconf

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will