we have ~16,000 windows client machines and the machines are reporting to a app
[serverClass:xom_TA-app1]
whitelist.0 = windows
machineTypesFilter = windows-intel,windows-x64
now we want to split ~1,500 point to app2 and the rest of 14,500 to point to app1
how can we achieve this without adding all the server names to whitelist as it will be very painful to manage?
Unfortunately the deployment server can only filter by os and hostname. If your environment has strict naming conventions (which is probably not the cas if you have that many hosts) you can use patterns in the whitelist filters, eg whitelist.0 = web[1-8]
, but otherwise you will have to put each row in there manually. There's a few ways you can do it outside of Splunk, for example we generate the serverclass.conf via script by querying an LDAP directory and generating serverclasses based on OU membership.
However, for a large fleet of windows clients, I'm guessing you want to capture the windows event logs. If so, you might investigate using the Windows Event Collector service (an MS Server Role) to collect all the logs from the endpoints, and then have universal forwarders running on your WEC hosts.
@muthu285kumar - Did the answer provided by jplumsdaine22 help provide a solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!
Unfortunately the deployment server can only filter by os and hostname. If your environment has strict naming conventions (which is probably not the cas if you have that many hosts) you can use patterns in the whitelist filters, eg whitelist.0 = web[1-8]
, but otherwise you will have to put each row in there manually. There's a few ways you can do it outside of Splunk, for example we generate the serverclass.conf via script by querying an LDAP directory and generating serverclasses based on OU membership.
However, for a large fleet of windows clients, I'm guessing you want to capture the windows event logs. If so, you might investigate using the Windows Event Collector service (an MS Server Role) to collect all the logs from the endpoints, and then have universal forwarders running on your WEC hosts.