Here's how I did it late last year. It works really well (I also have a better-documented version of this example at https://gist.github.com/sworisbreathing/d236895568eaf31da579).
In this example, we're focusing mostly on the TAs for SOS as well as an arbitrary app.
On the primary deployment server (e.g. deployment master), in serverclass.conf :
###########################################################
# Secondary deployment servers - Deployment Apps
###########################################################
[serverClass:secondaryDeploymentServersDeploymentApps]
targetRepositoryLocation = $SPLUNK_HOME/etc/deployment-apps
whitelist.0 = *SecondaryDeploymentServer*
stateOnClient = noop
[serverClass:secondaryDeploymentServersDeploymentApps:app:TA-sos_win]
[serverClass:secondaryDeploymentServersDeploymentApps:app:TA-sos]
###########################################################
# Secondary deployment servers - Self-Deployed Apps
###########################################################
[serverClass:secondaryDeploymentServers]
whitelist.0 = *SecondaryDeploymentServer*
[serverClass:secondaryDeploymentServers:app:foo]
restartSplunkd = true
###########################################################
# Linux/Unix Splunk Instances
# (note: this is probably not a comprehensive list)
###########################################################
[serverClass:NixHosts]
whitelist.0 = *
machineTypesFilter = linux-*, freebsd-*, darwin-*, sunos-*, aix-*
[serverClass:NixHosts:app:TA-sos]
restartSplunkd = true
###########################################################
# Windows Splunk Instances
###########################################################
[serverClass:WindowsHosts]
whitelist.0 = *
machineTypesFilter = windows-*
[serverClass:NixHosts:app:TA-sos_win]
restartSplunkd = true
On the secondary deployment server (e.g. deployment slave), in deploymentclient.conf :
[deployment-client]
clientName = SecondaryDeploymentServer
reloadDSOnAppInstall = true
[target-broker:PrimaryDeploymentServer]
targetUri = <deployment_master_fqdn>:<deployment_master_mgmt_port>
On the secondary deployment server (e.g. deployment slave), in serverclass.conf :
###########################################################
# Linux/Unix Splunk Instances
# (note: this is probably not a comprehensive list)
###########################################################
[serverClass:NixHosts]
whitelist.0 = *
machineTypesFilter = linux-*, freebsd-*, darwin-*, sunos-*, aix-*
[serverClass:NixHosts:app:TA-sos]
restartSplunkd = true
###########################################################
# Windows Splunk Instances
###########################################################
[serverClass:WindowsHosts]
whitelist.0 = *
machineTypesFilter = windows-*
[serverClass:NixHosts:app:TA-sos_win]
restartSplunkd = true
The big thing to call out here is that any time you're deploying to somewhere other than $SPLUNK_HOME/etc/apps , you need to specify stateOnClient = noop in serverclass.conf . Otherwise, you'll see a bunch of errors on the deployment client about not being able to properly install the app (and if you also specified restartSplunkd = true in serverclass.conf , the deployment client will just sit there and restart the Splunk service over and over again)
... View more