I have been working on integrating the Splunk Universal Forwarder into a system image that we will use to deploy to new assets going forwards, as per this Splunkbase Article.
I was wondering how this works with the deployment server? I know that the forwarders deployed with the images will reach out to the deployment server, but I was wondering if there is a way to automatically sort the new hosts into a certain server class, or whether this has to be done manually?
If it is helpful, we have a regex we can use to identify the specific assets - Would we put this into the serverclass whitelist?
first create your serverclasses, create the hosts (clients) whitelist with wild cards to match future forwarders
for example, lets imagine all your jukebox application servers has the naming convention: jukeboxXXXX
you can whilelist "jukebox*" in serverclass and every new forwarder that has the matching convention will happily join to disco
I love your example - I really do!
As it turns out, we use quite a weird naming convention that doesn't necessarily work with an asterisk wild card, however, whilst playing around with your suggestion, I noticed that the server class whitelist (in the deployment server GUI) supports PCRE-ish RegEx, so we tried it, it worked and away we went 🙂
Thank you for the comment that lead me to play around a bit 🙂
Splunk supports PCRE(ish) RegEx in the deployment server serverclass web GUI - We achieved the result by writing a PCRE compatible RegEx and applied it in the whitelist/blacklist.