Deployment Architecture

serverclass.conf: Do I need to write separate stanzas, or can I used wildcards to push apps to clients from the deployment server?

splunker12er
Motivator

serverclass.conf

I use the below config to push apps from my deployment server to the clients .
sos - App has been pushed successfully.
TA-* - i have many TA-add-ons in deployment server under the mentioned location. those apps are not pushed. Do i need to write separate stanzas? Or wildcards should work?

[serverClass:SearchHeadCfg]
repositoryLocation = /opt/splunk/etc/apps
whitelist.0 = 10.0.10.101*

[serverClass:SearchHeadCfg:app:sos]
stateOnClient = enabled
restartSplunkd = true

[serverClass:SearchHeadCfg:app:TA-*]
stateOnClient = enabled
restartSplunkd = true
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You can use wildcards for the whitelists and blacklists. But not for the application (TA) definition. So you have to create a stanza for each TA/app you want to deploy.

But do note, in your example that

whitelist.0 = 10.0.10.101*

Only matches 10.0.10.101.

You can do 10.0.10., or 10.0.10.1, or 10.0.10.10* etc. depending on what wild card matching you want to do. Also note that you can do the same from the GUI, and test your matches there instead of saving and reloading.

Refer to the spec file at : http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Serverconf

0 Karma

splunker12er
Motivator

I have verified under the location : /opt/splunk/var/run/tmp/SearchHeadCfg

bundles are not found for TA-addons. Only for sos can be seen

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...