Getting Data In

Deployment Server - Automated Client Deletion?


Our system provisioning process installs the Splunk UniversalForwarder while the system is on a provisioning network, and then moves the system to it's actual final network.

This results in two client records in the Forwarder Management web interface.

Is there a way to script out Client Deletion? I'd like to remove these duplicate client records in an automated way.

0 Karma


Splunk writes the info about the deployment client in serverclass.conf

It wouldn't be trivial, but you could certainly write a script that edits serverclass.conf; it is a text file.

More info here: serverclass.conf.spec and at Create Server Classes

After editing serverclass.conf, your script should issue the command

./splunk reload deploy-server

to have Splunk re-read the serverclass.conf file

Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...