Anyone having good luck using machineType to filter clients in the deployment manager? Here is a snippet of my serverclass.conf #Server Class for Windows [serverClass:windows] machineTypes=windows-intel,windows-x64 [serverClass:windows:app:winevt] stateOnClient=enabled restartSplunkd=true My app is called winevt and enables basic windows event collection. The problem is - Linux forwarders are picking up this configuration. Everything is 4.0.11 in this world right now. Anyone else experience this or am I misunderstanding the docs - it seemed like you didn't need a whitelist/blacklist if you were filtering the class by machineType. ... View more

So I have a lab box where I have applied 4.0.11 to my existing 4.0.10 installation. Ran the upgrade using rpm -U and didn't have any issues with the upgrade. After applying the upgrade however splunkweb fails to start (splunkd starts fine) Here is my web.conf from $SPLUNK_HOME/etc/system/local: [settings] enableSplunkWebSSL = 1 httpport = 443 mgmtHostPort = 127.0.0.1:8090 Here are the errors I see in splunkd.log: 05-06-2010 15:30:59.598 ERROR SSLCommon - Can't read key file /opt/splunk/etc/auth/server.pem 05-06-2010 15:30:59.598 ERROR ServerConfig - Couldn't initialize SSL Context for HTTPClient in ServerConfig 05-06-2010 15:31:03.204 ERROR SSLCommon - Can't read key file /opt/splunk/etc/auth/server.pem 05-06-2010 15:31:03.204 ERROR HTTPServer - SSL context could not be created - error in cert or password is wrong 05-06-2010 15:31:03.204 ERROR HTTPServer - SSL will not be enabled Here is the directory list of /opt/splunk/etc/auth/server.pem: [root@dctlallog03 local]# ls /opt/splunk/etc/auth/ -al total 44 drwx------ 4 splunk splunk 4096 May 6 15:03 . drwxr-xr-x 16 splunk splunk 4096 May 6 15:11 .. drwx--x--x 2 splunk splunk 4096 Apr 15 14:10 audit -r--r--r-- 1 splunk splunk 912 Apr 28 03:42 cacert.pem -r--r--r-- 1 splunk splunk 1875 Apr 28 03:42 ca.pem -rw-r--r-- 1 splunk splunk 17 Apr 15 14:10 ca.srl drwx--x--x 2 splunk splunk 4096 Apr 15 14:10 distServerKeys -rw-r--r-- 1 splunk splunk 963 Apr 15 14:10 privkeySecure.pem -rw-r--r-- 1 splunk splunk 586 Apr 15 14:10 req.pem -rw-r--r-- 1 splunk splunk 2689 Apr 15 14:10 server.pem -r-------- 1 splunk splunk 255 Apr 15 14:10 splunk.secret After upgrade I noticed that ca.srl, privkeySecure.pem, req.pem, and server.pem were is 600 mode so I tried a chmod 644 to see if that helped anything and it did not. Please let me know if this is a bug in the install or if I somehow corrupted this key during upgrade. Thanks, Dave ... View more

I have an "app" that I deploy with my 4.x deployment server. It sends savedsearches.conf, tags.conf, props.conf, eventtypes.conf and transforms.conf to my distributed indexers globally (I have 4 indexers - US, EMEA, Asia and Latin America). This ensures when I run a distributed search that I have appropriate tags, etc. in place on all indexers. In the 3.x world these configs pushed without issue. In 4.x I get the configuration to the boxes but the savedsearches, eventtypes, etc for example are not globally available. Can I define the deployment-app in such a way as to make all objects accessible in all apps. Basically want them to behave as if they were created in the search app. I have all my *.conf files in /opt/splunk/etc/deployment-apps/discovery_indexer/default on the deployment server and this ends up in /opt/splunk/etc/apps/discovery_indexer/default on my indexers. I saw reference to configuring local.meta on this page http://www.splunk.com/base/Documentation/4.0.10/Admin/Apparchitectureandobjectownership but I wasn't sure if this applied to apps delivered via deployment manager or not and also I couldn't find any detailed syntax on local.meta ... View more

I'm in the process of upgrading my deployment server to 4.x. I don't push configuration change that often and I have a lot of lightForwarders out there. My plan was to just upgrade to the new 4.x deployment server and sort of orphan my 3.x deployment client for a while. My question is - will a 3.x client "ignore" the 4.x deployment server. I.e. - I don't want stuff to get accidentally pushed to the 3.x clients out there as I am configuring/updating the 4.x deployment server. Thanks, Dave ... View more