serverclass.conf: Do I need to write separate stanzas, or can I used wildcards to push apps to clients from the deployment server?

[splunker12er]

serverclass.conf

I use the below config to push apps from my deployment server to the clients .
sos - App has been pushed successfully.
TA-* - i have many TA-add-ons in deployment server under the mentioned location. those apps are not pushed. Do i need to write separate stanzas? Or wildcards should work?

[serverClass:SearchHeadCfg]
repositoryLocation = /opt/splunk/etc/apps
whitelist.0 = 10.0.10.101*

[serverClass:SearchHeadCfg:app:sos]
stateOnClient = enabled
restartSplunkd = true

[serverClass:SearchHeadCfg:app:TA-*]
stateOnClient = enabled
restartSplunkd = true

[esix_splunk]

You can use wildcards for the whitelists and blacklists. But not for the application (TA) definition. So you have to create a stanza for each TA/app you want to deploy.

But do note, in your example that

whitelist.0 = 10.0.10.101*

Only matches 10.0.10.101.

You can do 10.0.10., or 10.0.10.1, or 10.0.10.10* etc. depending on what wild card matching you want to do. Also note that you can do the same from the GUI, and test your matches there instead of saving and reloading.

Refer to the spec file at : http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Serverconf

[splunker12er]

I have verified under the location : /opt/splunk/var/run/tmp/SearchHeadCfg

bundles are not found for TA-addons. Only for sos can be seen