Script out Deployment Client Removal?

[muebel]

When I look in the deploymentserver web interface, I see some Deployment Clients listed that I want to remove. Is it possible to script this out?

EDIT: These entries are duplicates of actual clients I want to keep. Whenever a client changes IP address, and new entry is created in the client list. The entries I want to remove are the ones that have the old IP address.

[lguinn2]

There are several ways to do this. Following is the cleanest method I could think of, but others may have better ideas.

1 - Make sure that the deployment clients are not listed in the underlying serverclass.conf file. Once the clients are removed from serverclass.conf, the deployment server will not pass along any configuration, even if the clients continue to phone in. Don't forget to reload the deployment server to force it to pick up any changes to serverclass.conf

2 - Write a script that removes or disables the deploymentclient.conf file on the deployment clients that you want to remove. This stops the clients from "phoning home" to the deployment server. Since deploymentclient.conf is just a text file, you can write the script using any language or technique that you like. If you want some ideas, just google "splunk install forwarder script" - you will get a list of sample scripts for installing forwarders. You could use a similar script/structure for your purpose.

[clamarkv]

I've been trying to figure out a nice way to do this, and this is what what i have come up with: 

https://gist.github.com/6d61726b760a/e6fef9c2e5d47c43a1ba2ae5bd659638

its a little python script runs a search on your deployment server which generates a list of guids, and then submits a delete request for each guid returned. 

My search is simply looking for clients that haven't reported in more than 24h but you could come up with whatever query you like.