Getting Data In

How Do I Remove Device From Splunk Server Class?

nmensah
Explorer

Hello everyone. I am managing Windows and Mac devices via the Splunk DMC. Because of an error I made in the Splunk Server Class whitelist policy, some of the Mac devices received the Windows Apps to forward logs to a Windows index. I have corrected the whitelist IP policy, but what's the best way to remove the Mac device from the wrong server classes since it's still showing up?

Do I just want to just log into the Mac devices and delete the wrong Apps?

0 Karma

nmensah
Explorer

Thank you! I realized that after making the corrections, I just needed to restart the Splunk service for the deployment server and everything updated. I'm no longer seeing Mac devices in Windows server classes.

0 Karma

solarboyz1
Builder

You don't need to restart the service, you can simply reload the deployment server:

/opt/splunk/bin/splunk reload deploy-server

That will cause the deployment server to reload, accepting any configuration changes.

0 Karma

solarboyz1
Builder

and apparently a hash symbol means to bold on this platform, my bad.

0 Karma

solarboyz1
Builder

Once you correct the entry in serverclass,conf the Mac device should no longer be in the wrong server class.

However, once added to the correct serverclass, it will not attempt to update any apps on the Mac device that are not defined in the Mac's current serverclass.

For example, if you defined serverClass A to get App SampleApp, and the Mac was accidently part of ServerClass A it recived SampleApp from the deployment server.

You then removed the Mac from serverClass A, and put it in serverClass B. Since serverClass B is not aware of SampleApp...it will not attempt to add/remove or modify the app from the Mac when they connect as serveClass B for the first time.

What you could do, is define SampleApp for serverclass B which you use for the Macs. reload deployment server. Then remove SampleApp from serverClass B and reload the deployment server. The deployment server should remove SampleApp from the systems that fall under serverClassB

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...