Deployment Architecture

Why can't I set up multiple stateOnClient parameters on the DeploymentServer?

Aftend1971
Explorer

For this serverclasses.conf

[global]
crossServerChecksum = true

[serverClass:for-fwd]
whitelist.0 = for-fwd
blacklist.1 = for-master
stateOnClient = enabled
blacklist.0 = for-head

[serverClass:for-head]
whitelist.0 = for-head
blacklist.1 = for-master
blacklist.0 = for-fwd
stateOnClient = enabled

[serverClass:for-master]
whitelist.0 = for-master
blacklist.1 = for-fwd
blacklist.0 = for-head
stateOnClient = noop

I get error in DS UI ( I want to use Web UI, not CLI)
03-23-2018 11:50:48.839 +0100 WARN DS_DC_Common - Attribute unsupported by UI: stanza=serverClass:for-master property=stateOnClient reason='2+ distinct values at this level'
It means that I should not have enabled more than 1 stateOnClient I guess if I set the same stateOnClient value on all of three classes, its OK.

I want to use it for Deploying to Cluster Master
http://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Updatepeerconfigurations#Use_deployment_se...

And also for deploying to SH and Forwarders but seems its impossible, at least without multiple DSs.

Any suggestions?
Thanks

0 Karma

jcrabb_splunk
Splunk Employee
Splunk Employee

Here is a document that covers Forwarder Management Compatibility:

http://docs.splunk.com/Documentation/Splunk/7.0.2/Updating/Forwardermanagementcompatibility#List_of_...

If you look in the table, for the setting stateOnClient, it states:

Single per-app setting across all server classes

In the notes section, below the table, it explains:

Single per-app setting across all server classes: The **stateOnClient** and **restartSplunkd** attributes are configured under the app-level stanzas. App-level stanzas include both an appName and a serverClassName component, like this: [serverClass::app:]. See "Use serverclass.conf to define server classes".

If you are not using forwarder management, you can configure those attributes differently depending on the server class, even for the same app. For example, in [serverClass:X:app:A], you can specify stateOnClient=enabled, while in [serverClass:Y:app:A] (same app, different server class), you can specify stateOnClient=disabled. So, depending on the server class, the same app will be either enabled or disabled when it gets downloaded to the client.

However, forwarder management allows only a single definition for each app, across all server classes in which it is used. So, [serverClass:X:app:A] and [serverClass:Y:app:A] must both configure stateOnClient identically. The same condition applies to restartSplunkd.

If you notice the 2nd paragraph, it says:

If you are not using forwarder management, you can configure those attributes differently depending on the server class, even for the same app.

So you can accomplish what you want, but you have to manage it through CLI. It is not supported in the gui.

Jacob
Sr. Technical Support Engineer

teunlaan
Contributor

I'm missing some parts of your code:

[serverClass:for-fwd]
whitelist.0 = for-fwd
blacklist.1 = for-master
[serverClass:for-fwd:app:app-for-forwarder]
stateOnClient=enabled
restartSplunkWeb = 0
restartSplunkd = 1

You set stateOnClient on the "app" part for the serverclass config

0 Karma

Aftend1971
Explorer

But I need to set it like this for every app that I want to push with specific stateOnClient value, right?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...