Dashboards & Visualizations

How to dynamically add servers to serverclass.conf Whitelist

muthu285kumar
New Member

we have ~16,000 windows client machines and the machines are reporting to a app
[serverClass:xom_TA-app1]
whitelist.0 = windows
machineTypesFilter = windows-intel,windows-x64

now we want to split ~1,500 point to app2 and the rest of 14,500 to point to app1

how can we achieve this without adding all the server names to whitelist as it will be very painful to manage?

0 Karma
1 Solution

jplumsdaine22
Influencer

Unfortunately the deployment server can only filter by os and hostname. If your environment has strict naming conventions (which is probably not the cas if you have that many hosts) you can use patterns in the whitelist filters, eg whitelist.0 = web[1-8] , but otherwise you will have to put each row in there manually. There's a few ways you can do it outside of Splunk, for example we generate the serverclass.conf via script by querying an LDAP directory and generating serverclasses based on OU membership.

However, for a large fleet of windows clients, I'm guessing you want to capture the windows event logs. If so, you might investigate using the Windows Event Collector service (an MS Server Role) to collect all the logs from the endpoints, and then have universal forwarders running on your WEC hosts.

View solution in original post

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@muthu285kumar - Did the answer provided by jplumsdaine22 help provide a solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

jplumsdaine22
Influencer

Unfortunately the deployment server can only filter by os and hostname. If your environment has strict naming conventions (which is probably not the cas if you have that many hosts) you can use patterns in the whitelist filters, eg whitelist.0 = web[1-8] , but otherwise you will have to put each row in there manually. There's a few ways you can do it outside of Splunk, for example we generate the serverclass.conf via script by querying an LDAP directory and generating serverclasses based on OU membership.

However, for a large fleet of windows clients, I'm guessing you want to capture the windows event logs. If so, you might investigate using the Windows Event Collector service (an MS Server Role) to collect all the logs from the endpoints, and then have universal forwarders running on your WEC hosts.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...