Deployment Architecture

Why am I getting error "Gap in numbered regexes: expected attribute=whitelist.104 not found" trying to delete hosts from serverclasses using the deployment server GUI?

a212830
Champion

Hi,

I am using the Deployment Server GUI, and when I try to remove hosts from the text box and save it, I get an error

In handler 'serverclasses': Gap in numbered regexes: expected attribute=whitelist.104 not found.

How can I remove hosts from the serverclass using this GUI?

0 Karma

kalianov
Path Finder

For example, If you has such stanzas for serverClass:XXX in your GUI whitelist textbox 192.168.0.1,192.168.0.2,192.168.0.3,192.168.0.4
in the $SPLUNK_HOME/etc/system/local/serverclass.conf
it's looks like:
[serverClass:XXX]
whitelist.0 = 192.168.0.1
whitelist.1 = 192.168.0.2
whitelist.2 = 192.168.0.3
whitelist.3 = 192.168.0.4
If you decided to delete from that list 192.168.0.2,192.168.0.3, 192.168.0.4
you'll probably get an error "Gap in numbered regexes: expected attribute=whitelist.3 not found" when you try to save changes.
it's because in your
$SPLUNK_HOME/etc/system/local/serverclass.conf
it's looks like:
[serverClass:XXX]
whitelist.0 = 192.168.0.1
whitelist.1 =
whitelist.2 =
whitelist.3 =

You can delete stanzas in serverclass.conf:
whitelist.1 =
whitelist.2 =
whitelist.3 =
and then just push save button on your GUI form for XXX app

season88481
Contributor

Thanks, Kalinaov,
That resolved my problem. 🙂

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Make sure that you aren't collecting configs from other serverclasses. If using the GUI, there should be only one, and most users put that file in $SPLUNK_HOME/etc/system/local. Check the compiled output of the file.

$SPLUNK_HOME/bin/splunk cmd btool serverclass list 

Read through the output of that command and make sure it is numbered correctly for all stanzas.

It will also behoove you to reduce the number of hosts in the file. Use wildcards. I've been able to compress your list of 104 into 4 lines.

[serverClass:fmrei_all_genesys_fwd]
whitelist.0 = gsysrtp*
whitelist.1 = gsysmmk*
whitelist.2 = vlrtp*
whitelist.3 = vlmmk*

This way you don't need to edit the file every time a new host is added that matches the wildcards.

0 Karma

a212830
Champion

Thanks. That wildcard won't work because there are other server that match those patterns that are not relevant to this setup.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Even if they aren't relevant to the setup, depending on your internal policy, it won't hurt anything to send down the App to the forwarder. If the inputs don't exist, the forwarder just ignores those paths. I would think it worth it for a simplified setup.

Did the btool report any errors with the regex patterns?

0 Karma

cramasta
Builder

I think you should login check out the serverclass.conf file on the deployment server and look at the specific serverClass that you are trying to modify. Sounds like you might have whitelist numbering that is not sequential and tripping up the GUI

0 Karma

a212830
Champion

Where is that kept on the deployments server?

0 Karma

cramasta
Builder

$SPLUNK_HOME$/etc/system/local/serverclass.conf

0 Karma

a212830
Champion

Thanks. I don't see anything wrong with this:

[serverClass:fmrei_all_genesys_fwd]
whitelist.0 = vlrtp148
whitelist.1 = vlrtp166
whitelist.10 = vlrtp223
whitelist.100 = gsysrtpp903
whitelist.101 = gsysrtpp911
whitelist.102 = gsysrtpp921
whitelist.103 = gsysmmkp656
whitelist.104 = gsysmmkp756
whitelist.105 = vlmmk192
whitelist.11 = vlrtp309
whitelist.12 = vlrtp291
whitelist.13 = vlrtp339
whitelist.14 = vlrtp672
whitelist.15 = vlrtp673
whitelist.16 = vlrtp321
whitelist.17 = vlrtp333
whitelist.18 = vlrtp286
whitelist.19 = vlrtp221
whitelist.2 = vlrtp157
whitelist.20 = vlrtp304
whitelist.21 = vlrtp303
whitelist.22 = vlrtp222
whitelist.23 = vlrtp226
whitelist.24 = vlrtp305
whitelist.25 = vlrtp311
whitelist.26 = vlrtp680
whitelist.27 = vlmmk87
whitelist.28 = vlmmk93
whitelist.29 = vlmmk94
whitelist.3 = vlrtp146
whitelist.30 = vlmmk122
whitelist.31 = vlmmk144
whitelist.32 = vlmmk128
whitelist.33 = vlmmk121
whitelist.34 = vlmmk120
whitelist.35 = vlmmk140
whitelist.36 = vlmmk143
whitelist.37 = vlmmk179
whitelist.38 = vlmmk185
whitelist.39 = vlmmk240
whitelist.4 = vlrtp144
whitelist.40 = vlmmk223
whitelist.41 = vlmmk272
whitelist.42 = vlmmk362
whitelist.43 = vlmmk361
whitelist.44 = vlmmk251
whitelist.45 = vlmmk92
whitelist.46 = vlmmk266
whitelist.47 = vlmmk217
whitelist.48 = vlmmk182
whitelist.49 = vlmmk236
whitelist.5 = vlrtp162
whitelist.50 = vlmmk235
whitelist.51 = vlmmk183
whitelist.52 = vlmmk188
whitelist.53 = vlmmk237
whitelist.54 = vlmmk242
whitelist.55 = vlmmk363
whitelist.56 = vlmmk86
whitelist.57 = vlmmk92
whitelist.58 = vlmmk95
whitelist.59 = vlmmk89
whitelist.6 = vlrtp165
whitelist.60 = vlrtp230
whitelist.61 = gsysmmkq803
whitelist.62 = gsysmmkq903
whitelist.63 = gsysrtpq803
whitelist.64 = gsysrtpq903
whitelist.65 = gsysmmkq901
whitelist.66 = gsysmmkq801
whitelist.67 = gsysmmkq811
whitelist.68 = gsysmmkq911
whitelist.69 = gsysmmkq821
whitelist.7 = vlrtp157
whitelist.70 = gsysmmkq921
whitelist.71 = gsysrtpq901
whitelist.72 = gsysrtpq801
whitelist.73 = gsysrtpq811
whitelist.74 = gsysrtpq911
whitelist.75 = gsysrtpq921
whitelist.76 = gsysrtpq821
whitelist.77 = gsysmmkq403
whitelist.78 = gsysmmkq303
whitelist.79 = gsysrtpq403
whitelist.8 = vlrtp218
whitelist.80 = gsysrtpq303
whitelist.81 = gsysmmkp653
whitelist.82 = gsysmmkp753
whitelist.83 = gsysmmkp801
whitelist.84 = gsysmmkp803
whitelist.85 = gsysmmkp811
whitelist.86 = gsysmmkp821
whitelist.87 = gsysmmkp901
whitelist.88 = gsysmmkp903
whitelist.89 = gsysmmkp911
whitelist.9 = vlrtp301
whitelist.90 = gsysmmkp921
whitelist.91 = gsysrtpp653
whitelist.92 = gsysrtpp656
whitelist.93 = gsysrtpp753
whitelist.94 = gsysrtpp756
whitelist.95 = gsysrtpp801
whitelist.96 = gsysrtpp803
whitelist.97 = gsysrtpp811
whitelist.98 = gsysrtpp821
whitelist.99 = gsysrtpp901

0 Karma

cramasta
Builder

what host are you trying to remove?

0 Karma

a212830
Champion

a whole bunch, where are intermittently spread throughout that list.

0 Karma

a212830
Champion

And shouldn't the gui handle that?

0 Karma

cramasta
Builder

I dont use the GUI as it doesn't support all the features that I want to use. Either there is a bug with the GUI manager or someone manually modified the serverclass.conf file.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...