Deployment Architecture

Deployment server: Edit of serverclass.conf required in all cases?

malmoore
Splunk Employee
Splunk Employee

Hi,

Let's say I have a large network of computers with universal forwarders installed on them.
Let's also say that they will all run the same app on their universal forwarders.
Let's additionally say I have a deployment server.

Will a deployment server by default deploy any apps installed in $SPLUNK_HOME/etc/deployment-apps?

For example, if I configure the universal forwarders to all point to the deployment server, and then configure and place my app into $SPLUNK_HOME/etc/deployment-apps on my deployment server, must I also edit serverclass.conf before the deployment server will begin to deploy apps to the universal forwarders?

0 Karma

kristian_kolb
Ultra Champion

Yes, that is where you specify WHICH deployment-client (i.e. forwarder) should get WHICH app.

That being said, if your serverclass.conf has stanzas like this;

[serverClass:blah]
whitelist.0=*

[serverClass:blah:app:foo]

you do not need to edit serverclass.conf if you've edited the contents of the foo-app. But you will need to reload the deployment server configuration in order for the DS to realize that the foo app has changed.

$SPLUNK_HOME/bin/splunk reload deploy-server

UPDATE:

If you only have one app to be delivered to your hundreds of (all) forwarders
- and you have already configured the deploymentclient.conf on all of them.
- and you have already created your app,
- and put it into $SPLUNK_HOME/etc/deployment-apps on your DS.

Congrats! You've done all the hard stuff. How hard is it to just inform your splunk server that it should also act as a DS, by creating a serverclass.conf $SPLUNK_HOME/etc/system/local and restarting.

No serverclass.conf. No DS. There is no default.

Hope this helps,

Kristian

0 Karma

kristian_kolb
Ultra Champion

see update

0 Karma

malmoore
Splunk Employee
Splunk Employee

So even if I have:

  • only one app to deliver
  • configured my deployment clients to connect to this DS
  • placed my app in $SPLUNK_HOME/etc/deployment-apps

you're saying I still need to edit serverclass.conf to include at least the [global] stanza and

 [serverClass:blah:app:my-app]     

?

It would seem to me that, with the defaults, I should not have to make changes to serverclass.conf in this specific scenario where I have one app, all clients should get that app, and the app is on the deployment server.

Appreciate the guidance on this.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...