Deployment Architecture

How to reconstitute serverclass.conf

w199284
Explorer

I've been using the UI to manage serverclasses for my universal forwarders. Somehow, I've managed to get the serverclass.conf split across ...splunk/etc/apps/search/local and .../splunk/etc/system/local/

I don't know how I accomplished that but I want to merge them. It seems easy to do. Stop the splunk service, merge the two files in one location, start the splunk service. What am I missing? Thank you for your consideration!

0 Karma

w199284
Explorer

Lot's of great answers! Thanks everyone! It's just that, with Splunk, I've been caught with my pants down doing something "simple" that resulted in a temporary, and embarrassing, loss of functionality.

0 Karma

woodcock
Esteemed Legend

Use btool and it is SUPER DUPER easy:

/opt/splunk/bin/splunk severclass list > /tmp/serverclass.conf

You can also examine serverclass.xml which should also have everything in one place; I think it is here:

/opt/splunk*/var/run/serverclass.xml 
0 Karma

MuS
SplunkTrust
SplunkTrust

Just a slight modification to it:

$SPLUNK_HOME/bin/splunk btool serverclass list --debug | grep -v 'system/default' > /tmp/serverclass.conf

Do don't want to keep all the default settings in your config 😉

cheers, MuS

woodcock
Esteemed Legend

YES, too true!

0 Karma

burwell
SplunkTrust
SplunkTrust

Could you use btool to list what you have?

/opt/splunk/bin/splunk btool serverclass list

And if you want to see where each is coming from

/opt/splunk/bin/splunk btool serverclass list --debug

ddrillic
Ultra Champion

You are not missing much ; -)

The Splunk community does seem to agree that a solid, extremely large serverclass.conf is the right design choice, even though the UI stirs you to the app based serverclass.confs.

We ended up speaking about it recently at Do big implementations break down the serverclass.conf into multiple files?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...