whitelisted to receive configuration from Splunk Deployment Server

[SampathkumarK]

How to check if the host has been correctly whitelisted to receive configuration from Splunk Deployment Server?

[gcusello]

Hi @SampathkumarK ,

in addition to the other hints: in the bottom of the ServerClass form, you have the preview of clients in the serverclass, so you can immediately check if the whitelist is correctly running.

Then you can go in the clients form and see the serverclasses enabled for those clients.

Ciao.

Giuseppe

[SampathkumarK]

Thanks in tonn for your prompt response

[deepakc]

You can check via the below REST command in the Splunk search bar on the Deployment Server to see the settings 

| rest splunk_server=local /services/configs/conf-serverclass
| fields crossServerChecksum, disabled, endpoint, filterType, id, repositoryLocation, restartSplunkWeb, restartSplunkd, splunk_server, stateOnClient, targetRepositoryLocation, title, whitelist.0
| rename title AS server_class_name
| table server_class_name, whitelist.0, crossServerChecksum, disabled,  endpoint, filterType, id, repositoryLocation, restartSplunkWeb, restartSplunkd, splunk_server, stateOnClient, targetRepositoryLocation 

[tej57]

Hello @SampathkumarK ,

When you whitelist or blacklist a particular host for a serverclass from the web UI, it creates the configuration in serverclass.conf config file with the respective parameters. You can match the regex for whitelist/blacklist with the required pattern and validate if the host is matching the pattern or not. Also, phoneHome happens with every phoneHome interval that has been defined.

You can find the detailed explanation in the following document - https://docs.splunk.com/Documentation/Splunk/9.2.1/Updating/Useserverclass.conf

Thanks,
Tejas.