Deployment Architecture

What happens to deployed apps on deployment clients when phoning home and doesn't find serverclass configs for a whitelisted IP?

splunker12er
Motivator

What happens to the deployed apps in the deployments-clients when it phones home and doesn't find the serverclass configs for that IP address? OR the configs/apps exist, but the whitelist IP is removed?

Will it remove the deployed apps & configs on the client ?

0 Karma

Runals
Motivator

Yes if a client once matched a stanza in your serverclass.conf file and no longer does the app(s) associated with that stanza will be removed. Here is one of my favorite-est admin searches to see when apps are installed or removed on endpoints. It was initially built back in the olden days of 5.x so as the forwarder environment migrated to 6.x I wanted to see that. I should reverse the emphasis to highlight remaining 5.x forwarders.

index=_internal sourcetype=splunkd deployedapplication (removing OR installing OR uninstalling) NOT "removing app at location" | rex "DeployedApplication - (?<Action>\S+)\sapp(\=|\S+\s)(?<App>\S+)" | eval Action = case(Action="Removing" , "Removing" , Action="Uninstalling" , "Removing" , Action="Installing" , "Installing" , 1=1,"Fix me") | rex "(Removing|Installing) app=(?<Version>\S+)" | eval Version = if(isnull(Version),"5x","-= 6x =-") | dedup _time host Action App Version | table _time host Action App Version | sort -_time
0 Karma

mtranchita
Communicator

If I follow your question right…
When an app on a deployment client is managed by the deployment server and the client no longer matches the serverclass or the app is removed from the deployment server repository then the app will be removed from the deployment client.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...