Security

Script out Deployment Client Removal?

muebel
SplunkTrust
SplunkTrust

When I look in the deploymentserver web interface, I see some Deployment Clients listed that I want to remove. Is it possible to script this out?

EDIT: These entries are duplicates of actual clients I want to keep. Whenever a client changes IP address, and new entry is created in the client list. The entries I want to remove are the ones that have the old IP address.

0 Karma

lguinn2
Legend

There are several ways to do this. Following is the cleanest method I could think of, but others may have better ideas.

1 - Make sure that the deployment clients are not listed in the underlying serverclass.conf file. Once the clients are removed from serverclass.conf, the deployment server will not pass along any configuration, even if the clients continue to phone in. Don't forget to reload the deployment server to force it to pick up any changes to serverclass.conf

2 - Write a script that removes or disables the deploymentclient.conf file on the deployment clients that you want to remove. This stops the clients from "phoning home" to the deployment server. Since deploymentclient.conf is just a text file, you can write the script using any language or technique that you like. If you want some ideas, just google "splunk install forwarder script" - you will get a list of sample scripts for installing forwarders. You could use a similar script/structure for your purpose.

0 Karma

clamarkv
Explorer

I've been trying to figure out a nice way to do this, and this is what what i have come up with: 

https://gist.github.com/mark-vandenbos/e6fef9c2e5d47c43a1ba2ae5bd659638

its a little python script runs a search on your deployment server which generates a list of guids, and then submits a delete request for each guid returned. 

My search is simply looking for clients that haven't reported in more than 24h but you could come up with whatever query you like.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...