Splunk Light: Server Classes

[cmschube]

This questions was asked before, but still haven't gotten a really good answer out of it. Or maybe I'm just doing this all wrong.

I'm trying to use Splunk Light to monitor the Security Logs of several Windows devices. Whenever I add a new host to monitor, rather than being able to add the host to the Server Class that I have called "Windows Hosts" in the "Data Inputs -> Event Logs Collections" page, I have to create a new Server Class and add all the hosts again to the new class. If I try to click on the existing Server Class to edit it, I get a "Page Not Found" message.

Is this correct? Am I doing something wrong? Is Light only supposed to be used for one device?

[ChrisG]

The best answer I could find out is the one I posted here:

Deployment server does not work in Splunk Light today. Because Splunk Light and Splunk Enterprise share a code base and the UI is defined by licensing, there are a few defects where features that are only available in Enterprise partially appear in Light. That is why you are seeing that server class link.

[cmschube]

Hey Chris -

Thanks, that makes sense. So, I guess having to go back and add a new server class every time I add a new host, is that "correct" procedure?

[ChrisG]

It seems you're into a buggy area of the product here. If your suggestion works for you, try it! And if you are a paying customer, I suggest opening a Support case for this.