Script out Deployment Client Removal?


When I look in the deploymentserver web interface, I see some Deployment Clients listed that I want to remove. Is it possible to script this out?

EDIT: These entries are duplicates of actual clients I want to keep. Whenever a client changes IP address, and new entry is created in the client list. The entries I want to remove are the ones that have the old IP address.

0 Karma


There are several ways to do this. Following is the cleanest method I could think of, but others may have better ideas.

1 - Make sure that the deployment clients are not listed in the underlying serverclass.conf file. Once the clients are removed from serverclass.conf, the deployment server will not pass along any configuration, even if the clients continue to phone in. Don't forget to reload the deployment server to force it to pick up any changes to serverclass.conf

2 - Write a script that removes or disables the deploymentclient.conf file on the deployment clients that you want to remove. This stops the clients from "phoning home" to the deployment server. Since deploymentclient.conf is just a text file, you can write the script using any language or technique that you like. If you want some ideas, just google "splunk install forwarder script" - you will get a list of sample scripts for installing forwarders. You could use a similar script/structure for your purpose.

0 Karma


I've been trying to figure out a nice way to do this, and this is what what i have come up with:

its a little python script runs a search on your deployment server which generates a list of guids, and then submits a delete request for each guid returned. 

My search is simply looking for clients that haven't reported in more than 24h but you could come up with whatever query you like.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...