Splunk Search
Highlighted

How does integrating Splunk Universal Forwarder into a Windows System Image work with a deployment server?

Communicator

Hi all,

I have been working on integrating the Splunk Universal Forwarder into a system image that we will use to deploy to new assets going forwards, as per this Splunkbase Article.

I was wondering how this works with the deployment server? I know that the forwarders deployed with the images will reach out to the deployment server, but I was wondering if there is a way to automatically sort the new hosts into a certain server class, or whether this has to be done manually?

0 Karma
Highlighted

Re: How does integrating Splunk Universal Forwarder into a Windows System Image work with a deployment server?

Communicator

If it is helpful, we have a regex we can use to identify the specific assets - Would we put this into the serverclass whitelist?

0 Karma
Highlighted

Re: How does integrating Splunk Universal Forwarder into a Windows System Image work with a deployment server?

SplunkTrust
SplunkTrust

first create your serverclasses, create the hosts (clients) whitelist with wild cards to match future forwarders
for example, lets imagine all your jukebox application servers has the naming convention: jukeboxXXXX
you can whilelist "jukebox*" in serverclass and every new forwarder that has the matching convention will happily join to disco

Highlighted

Re: How does integrating Splunk Universal Forwarder into a Windows System Image work with a deployment server?

Communicator

I love your example - I really do!

As it turns out, we use quite a weird naming convention that doesn't necessarily work with an asterisk wild card, however, whilst playing around with your suggestion, I noticed that the server class whitelist (in the deployment server GUI) supports PCRE-ish RegEx, so we tried it, it worked and away we went 🙂

Thank you for the comment that lead me to play around a bit 🙂

Highlighted

Re: How does integrating Splunk Universal Forwarder into a Windows System Image work with a deployment server?

Communicator

Splunk supports PCRE(ish) RegEx in the deployment server serverclass web GUI - We achieved the result by writing a PCRE compatible RegEx and applied it in the whitelist/blacklist.

View solution in original post

0 Karma