Deployment Architecture

Filter deployment by machineType not working?

dave_duvall
Explorer

Anyone having good luck using machineType to filter clients in the deployment manager? Here is a snippet of my serverclass.conf

#Server Class for Windows
[serverClass:windows]
machineTypes=windows-intel,windows-x64

[serverClass:windows:app:winevt]
stateOnClient=enabled
restartSplunkd=true

My app is called winevt and enables basic windows event collection. The problem is - Linux forwarders are picking up this configuration. Everything is 4.0.11 in this world right now.

Anyone else experience this or am I misunderstanding the docs - it seemed like you didn't need a whitelist/blacklist if you were filtering the class by machineType.

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

machineTypes only takes effect if the machine has failed the whitelist/blacklist filters. The easiest way to make it work is to add:

[global]
blacklist.0=*

to the top of your serverclass.conf file.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

machineTypes only takes effect if the machine has failed the whitelist/blacklist filters. The easiest way to make it work is to add:

[global]
blacklist.0=*

to the top of your serverclass.conf file.

dave_duvall
Explorer

Thanks - that was the trick...

0 Karma

piebob
Splunk Employee
Splunk Employee

cool, i'll make sure this gets updated in the deployment server doc.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...