- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Is there a way to add forwarder to a deployment cl...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm looking to setup a deployment server in my environment. However, I can't seem to find the answer to this question in the docs so far, maybe someone can help.
Can I add a forwarder to a particular class from the forwarder itself? Either in a conf file on the forwarder or via an API call to the deployment server would work for my use case. Honestly, anything I can automate would work, but I don't want to get too hacky 🙂
We have servers installed weekly, so I want them to automatically get a list of "server classes" without me having to go through the GUI on the deployment server to add each new server to it's appropriate classes. I found that I can automatically add a server to the deployment server through a script with
splunk set deploy-poll IP_address:management_port
splunk restart
But then it seems like I have to go to the deployment server GUI to set up the forwarder after it's added. Is there a similar call from the forwarder to join a server class or a set of server classes?
If I can clarify the question at all, let me know.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Yes you can add clients to deployment server using REST API, see POST method here http://docs.splunk.com/Documentation/Splunk/7.1.3/RESTREF/RESTdeploy#deployment.2Fserver.2Fservercla... but the thing is, it is quite complicated because while firing POST REST API for new client you need to supply whitelist.* OR blacklist.* and you need to replace * with values starting from 0 and to be consecutive.
Now let's say you already have 2 client whitelisted in serverclass abc, when you want to add 3rd client in serverclass abc you need to provide whitelist.2 = newclient in REST API POST request and for this first you need to fire same REST API with GET request to find whitelist-size and based on that output you can fire POST REST API for new client.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Yes you can add clients to deployment server using REST API, see POST method here http://docs.splunk.com/Documentation/Splunk/7.1.3/RESTREF/RESTdeploy#deployment.2Fserver.2Fservercla... but the thing is, it is quite complicated because while firing POST REST API for new client you need to supply whitelist.* OR blacklist.* and you need to replace * with values starting from 0 and to be consecutive.
Now let's say you already have 2 client whitelisted in serverclass abc, when you want to add 3rd client in serverclass abc you need to provide whitelist.2 = newclient in REST API POST request and for this first you need to fire same REST API with GET request to find whitelist-size and based on that output you can fire POST REST API for new client.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This definitely seems doable, thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have converted my comment to answer so that you can accept it if it really helped you.
Detecting Remote Code Executions With the Splunk Threat Research Team
Observability | Use Synthetic Monitoring for Website Metadata Verification
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
