Getting Data In

Deployment Server - Automated Client Deletion?

muebel
SplunkTrust
SplunkTrust

Our system provisioning process installs the Splunk UniversalForwarder while the system is on a provisioning network, and then moves the system to it's actual final network.

This results in two client records in the Forwarder Management web interface.

Is there a way to script out Client Deletion? I'd like to remove these duplicate client records in an automated way.

0 Karma

lguinn2
Legend

Splunk writes the info about the deployment client in serverclass.conf

It wouldn't be trivial, but you could certainly write a script that edits serverclass.conf; it is a text file.

More info here: serverclass.conf.spec and at Create Server Classes

After editing serverclass.conf, your script should issue the command

./splunk reload deploy-server

to have Splunk re-read the serverclass.conf file

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...