Deployment Architecture

What is the Best practice for stateOnClient parameter on deployment-server and clients ?

koshyk
Super Champion

hi folks
just wanted to get your view on large scale installations of Universal Forwarders and apps in them.
What do you prefer? To use the default value of stateOnClient = enabled OR to use noop ?

I can see pros & cons of both approaches, but just wanted to check if you have seen issues on large scale installations.
I'm more tending towards noop these days with restartIfNeeded option, so all apps in the clients are in-line with master deployment-server. Any experience from you guys much appreciated.

0 Karma
1 Solution

sloshburch
Splunk Employee
Splunk Employee

Hi! It always depends on what your goal is. I typically don't mess with that option and leave it as default. I've always seen it more as a feature for disabling an app at scale without removing it.

Remember that using the restartIfNeeded has some dependencies (see reference: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverclassconf).

What about normal DS use would imply the "clients would not be in-line with the master deployment server"? Are you referring to using multiple deployment servers (not recommended) or have I misunderstood the question?

View solution in original post

sloshburch
Splunk Employee
Splunk Employee

Hi! It always depends on what your goal is. I typically don't mess with that option and leave it as default. I've always seen it more as a feature for disabling an app at scale without removing it.

Remember that using the restartIfNeeded has some dependencies (see reference: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverclassconf).

What about normal DS use would imply the "clients would not be in-line with the master deployment server"? Are you referring to using multiple deployment servers (not recommended) or have I misunderstood the question?

koshyk
Super Champion

I meant to say, clients would always follow status in deployment server. So if I disable in dep-server, it will disable in Client too without needing to worry about the stateofClient

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Yea, so long as you're referring to the config within app.conf. Exceptions to this would be the apps that come installed with splunk, you probably don't want to mess with those. Are we saying the same thing?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...