Deployment Architecture

Deployment Server question

beaunewcomb
Communicator

Can someone verify that this kind of deployment would work?

I'm deploying Splunk in a small environment of around 10 servers. Rather than manage Splunk on each one I want to use deployment server. The environment is made up of 3 different smaller environments (Dev, QA, Prod), with 3 classes of servers within each (Web, Batch, DB). Server naming convention example is: Dev-Web-1a1 (1a1 is a location code)

What I want to do is plan my serverclass.conf so I can say ALL DEV servers get this app. ALL DEV WEB servers get all of the above + these web-specific apps.

Given the naming convention and deployment model would the approach below work? Would there be any conflict with nesting groups based on hostname like this? Also, does deployment server go by the name set in server.conf? These servers are actually using random hostnames, but I want to inject a friendly name in server.conf.

######################
# QA  Environment  #
######################
[serverClass:QA]
restartSplunkd = true
whitelist.0 = *qa*

############
# QA-Web #
############
[serverClass:QAWeb]
restartSplunkd = true
whitelist.0 = *qa-web*
Tags (1)
0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

When matching hostname it is going to match based on the name sent by the forwarder. The forwarder runs a hostname command like you would do at a command line and reports that as the value. You can put hosts in multiple classes and it will pull "apps" you assign those groups and use the normal splunk order of precedence for applying configurations. I often do a splunk list deploy-clients and see how the hostnames are coming in before making decisions on assigning them by name vs ip in the serverclass.conf

View solution in original post

0 Karma

starcher
SplunkTrust
SplunkTrust

When matching hostname it is going to match based on the name sent by the forwarder. The forwarder runs a hostname command like you would do at a command line and reports that as the value. You can put hosts in multiple classes and it will pull "apps" you assign those groups and use the normal splunk order of precedence for applying configurations. I often do a splunk list deploy-clients and see how the hostnames are coming in before making decisions on assigning them by name vs ip in the serverclass.conf

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...