I'm looking to setup a deployment server in my environment. However, I can't seem to find the answer to this question in the docs so far, maybe someone can help.
Can I add a forwarder to a particular class from the forwarder itself? Either in a conf file on the forwarder or via an API call to the deployment server would work for my use case. Honestly, anything I can automate would work, but I don't want to get too hacky 🙂
We have servers installed weekly, so I want them to automatically get a list of "server classes" without me having to go through the GUI on the deployment server to add each new server to it's appropriate classes. I found that I can automatically add a server to the deployment server through a script with
splunk set deploy-poll IP_address:management_port splunk restart
But then it seems like I have to go to the deployment server GUI to set up the forwarder after it's added. Is there a similar call from the forwarder to join a server class or a set of server classes?
If I can clarify the question at all, let me know.
Yes you can add clients to deployment server using REST API, see POST method here http://docs.splunk.com/Documentation/Splunk/7.1.3/RESTREF/RESTdeploy#deployment.2Fserver.2Fservercla... but the thing is, it is quite complicated because while firing POST REST API for new client you need to supply
blacklist.* and you need to replace
* with values starting from 0 and to be consecutive.
Now let's say you already have 2 client whitelisted in serverclass
abc, when you want to add 3rd client in serverclass
abc you need to provide
whitelist.2 = newclient in REST API POST request and for this first you need to fire same REST API with GET request to find
whitelist-size and based on that output you can fire POST REST API for new client.
I have converted my comment to answer so that you can accept it if it really helped you.