Deployment Architecture

deployment server - add IP range to ServerClass to have servers added to deployment server automatically

kcooper
Communicator

I have a lab that has an IP range that they use for their servers. Is there anyway to have the servers automatically available in the deployment server? I have searched for similar questions but not using IP ranges. We also have labs with naming conventions?
ex

serverclass = lab_servers 
whitelist = 128.88.8.*

or

serverclass = lab_srv2
whitelist = studentLab*

Would that actually add the servers with this range of IPs?
Or would this add the servers with studentlab1, studentlab2, etc?

Any help is appreciated.

0 Karma

woodcock
Esteemed Legend

Yes, both of these will work:

serverclass = lab_servers 
whitelist = 128.88.8.*

AND

serverclass = lab_srv2
whitelist = studentLab*

That is the beauty of the Deployment Server and ServerClass whitelists. Set it once with wildcards and you never have to touch it again.

0 Karma

kcooper
Communicator

Is there a way to set it with an IP range. For ex, 128.88.8.10 to 128.88.8.40?

0 Karma

woodcock
Esteemed Legend

Not really. It does not support CIDRs but it does support typical wildcarding so you could do 128.88.8.*

0 Karma

vishaltaneja070
Motivator

@kcooper

It will work for both if DNS is linked with IP then you can search with any one.

if you want to try, then create a server class and try to Preview the results.

0 Karma

kcooper
Communicator

Thx you for the quick response.

I have tried both (added IP xxx.xxx.x.* and srv name labsrv*) and the deployment server has not found any of the servers. The servers are in DNS

serverclass.conf:

[serverClass:IPAC_Windows_UF]
whitelist.0 = scom12*
whitelist.1 = 129.83.8.*

in the deployment server console I click Preview but nothing appears.
The above are listed under Edit Clients > Include (whitelist) but the deployment server can't find the servers.

Any suggestions?

0 Karma

vishaltaneja070
Motivator

are these servers showing in All Client list?

0 Karma

kcooper
Communicator

I was able to get this to work.
Thanks for the help

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...