Getting Data In

Is there a way to add forwarder to a deployment class automatically?

Path Finder

I'm looking to setup a deployment server in my environment. However, I can't seem to find the answer to this question in the docs so far, maybe someone can help.

Can I add a forwarder to a particular class from the forwarder itself? Either in a conf file on the forwarder or via an API call to the deployment server would work for my use case. Honestly, anything I can automate would work, but I don't want to get too hacky 🙂

We have servers installed weekly, so I want them to automatically get a list of "server classes" without me having to go through the GUI on the deployment server to add each new server to it's appropriate classes. I found that I can automatically add a server to the deployment server through a script with

splunk set deploy-poll IP_address:management_port
splunk restart

But then it seems like I have to go to the deployment server GUI to set up the forwarder after it's added. Is there a similar call from the forwarder to join a server class or a set of server classes?

If I can clarify the question at all, let me know.

1 Solution

SplunkTrust
SplunkTrust

Hi,

Yes you can add clients to deployment server using REST API, see POST method here http://docs.splunk.com/Documentation/Splunk/7.1.3/RESTREF/RESTdeploy#deployment.2Fserver.2Fservercla... but the thing is, it is quite complicated because while firing POST REST API for new client you need to supply whitelist.* OR blacklist.* and you need to replace * with values starting from 0 and to be consecutive.

Now let's say you already have 2 client whitelisted in serverclass abc, when you want to add 3rd client in serverclass abc you need to provide whitelist.2 = newclient in REST API POST request and for this first you need to fire same REST API with GET request to find whitelist-size and based on that output you can fire POST REST API for new client.

View solution in original post

SplunkTrust
SplunkTrust

Hi,

Yes you can add clients to deployment server using REST API, see POST method here http://docs.splunk.com/Documentation/Splunk/7.1.3/RESTREF/RESTdeploy#deployment.2Fserver.2Fservercla... but the thing is, it is quite complicated because while firing POST REST API for new client you need to supply whitelist.* OR blacklist.* and you need to replace * with values starting from 0 and to be consecutive.

Now let's say you already have 2 client whitelisted in serverclass abc, when you want to add 3rd client in serverclass abc you need to provide whitelist.2 = newclient in REST API POST request and for this first you need to fire same REST API with GET request to find whitelist-size and based on that output you can fire POST REST API for new client.

View solution in original post

Path Finder

This definitely seems doable, thank you.

0 Karma

SplunkTrust
SplunkTrust

I have converted my comment to answer so that you can accept it if it really helped you.

0 Karma