Deployment Architecture

Custom Deployment Serverclass:app

samhodgson
Path Finder

Hi All,

I had 2 serverclasses (servers and workstations) and I wanted to add a custom config for the Splunk_TA(technology add-on)_windows app on the DomainControllers so have created a DCs serverclass along with a Splunk_TA_windows app configuration in serverclass.conf as follows:

    [serverClass:Servers:app:Splunk_TA_windows]
    restartSplunkWeb = 0
    restartSplunkd = 1
    stateOnClient = enabled

    [serverClass:DomainControllers:app:Splunk_TA_windows]
    restartSplunkWeb = 0
    restartSplunkd = 1
    stateOnClient = enabled
    repositoryLocation = /opt/splunk/etc/deployment-apps/dcs/Splunk_TA_windows

I have removed the whitelist/blacklists from the above snippet. This is deploying the Splunk_TA_windows app configuration from the standard deployment-apps directory to the domain controllers as opposed to the config located in the defined repository location. The domain controllers are in the DomainControllers serverclass and the web console shows that they have Splunk_TA_windows deployed to them after my config changes.

Do I need to provide a unique name for the app?

Also, for some reason I have my deployment config for servers and workstations split across 2 files despite configuring them both in the web console:

Servers: /opt/splunk/etc/apps/search/local/serverclass.conf

Workstations: /opt/splunk/etc/system/local/serverclass.conf

I have been reloading the deployment server after making config changes.

Any assistance on the above would be greatly appreciated!

0 Karma
1 Solution

samhodgson
Path Finder

So it looks like the multiple serverclass files is a known issue:

http://docs.splunk.com/Documentation/Splunk/7.0.1/Updating/Useserverclass.conf

The reason my above configuration was failing was because I had the Splunk_TA_windows app for the DC's inside a DC's subfolder in the deployment apps folder. I have moved it into the deployed apps folder and called it Splunk_TA_windows_dc, assigned it to the domaincontroller serverclass and it is now deploying and working as it should.

I also moved all of my config into the system/local/serverclass.conf and renamed the one under the search app directory.

View solution in original post

0 Karma

samhodgson
Path Finder

So it looks like the multiple serverclass files is a known issue:

http://docs.splunk.com/Documentation/Splunk/7.0.1/Updating/Useserverclass.conf

The reason my above configuration was failing was because I had the Splunk_TA_windows app for the DC's inside a DC's subfolder in the deployment apps folder. I have moved it into the deployed apps folder and called it Splunk_TA_windows_dc, assigned it to the domaincontroller serverclass and it is now deploying and working as it should.

I also moved all of my config into the system/local/serverclass.conf and renamed the one under the search app directory.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...