serverclass.conf
I use the below config to push apps from my deployment server to the clients .
sos - App has been pushed successfully.
TA-* - i have many TA-add-ons in deployment server under the mentioned location. those apps are not pushed. Do i need to write separate stanzas? Or wildcards should work?
[serverClass:SearchHeadCfg]
repositoryLocation = /opt/splunk/etc/apps
whitelist.0 = 10.0.10.101*
[serverClass:SearchHeadCfg:app:sos]
stateOnClient = enabled
restartSplunkd = true
[serverClass:SearchHeadCfg:app:TA-*]
stateOnClient = enabled
restartSplunkd = true
You can use wildcards for the whitelists and blacklists. But not for the application (TA) definition. So you have to create a stanza for each TA/app you want to deploy.
But do note, in your example that
whitelist.0 = 10.0.10.101*
Only matches 10.0.10.101.
You can do 10.0.10., or 10.0.10.1, or 10.0.10.10* etc. depending on what wild card matching you want to do. Also note that you can do the same from the GUI, and test your matches there instead of saving and reloading.
Refer to the spec file at : http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Serverconf
I have verified under the location : /opt/splunk/var/run/tmp/SearchHeadCfg
bundles are not found for TA-addons. Only for sos can be seen