<  Back |Home| Next  >

Splunk deployment server   | How to configure serverclass.conf

Deployment server is splunk component/feature which manages and updates all member splunk  servers. Member servers may be forwarder, indexer and search head. There is no separate install file  for splunk deployment server. We just need to enable deployment server attributes available in serverclass.conf file to promote any splunk server as deployment server. Deployment server basically  saves configurations and apps from all member servers and distributes changes made to them to all  servers avoiding rework and human mistakes. Even we can use deployment server to handle proper restart of other member servers.

splunk deployment server port:


The deployment client (the forwarder) connects to the Splunk management port (default 8089) on the deployment server.

 Splunk deployment server licenses?

As its deployment server is not a seprate component we don’t need any seprate license.

How many deployment servers to use?

If your environment contains overall less than 30 servers then no need to use dedicated deployment server.If number of splunk servers in your environment are 30-300 then using seprate server as deployment server is recommended.

Deployment server components:


 deployment server is the tool for distributing configurations, apps, and content updates to groups of Splunk Enterprise instances. You can use it to distribute updates to most types of Splunk Enterprise components: forwarders, non-clustered indexers, and search heads.


Key elements of the architecture of deployment server acts as a centralized configuration manager for any number of other instances, called "deployment clients". Any full Splunk Enterprise instance - even one indexing data locally - can act as a deployment server. A deployment server cannot be a client of itself.

A deployment client is a Splunk Enterprise instance remotely configured by a deployment server. Deployment clients can be forwarders, indexers, or search heads. Each deployment client belongs to one or more server classes.

A deployment app is a set of content (including configuration files) maintained on the deployment server and deployed as a unit to clients of a server class. A deployment app might consist of just a single configuration file, or it can consist of many files. Over time, an app can be updated with new content and then redeployed to its designated clients. The deployment app can be an existing Splunk Enterprise app or one developed solely to group some content for deployment purposes.

Note: The term "app" has a somewhat different meaning in the context of the deployment server from its meaning in the general Splunk Enterprise context

A server class is a group of deployment clients that share one or more defined characteristics. For example, you can group all Windows clients into one server class and all Linux clients into another server class. You use server classes to map a group of deployment clients to one or more deployment apps. By creating a server class, you are telling the deployment server that a specific set of clients should receive configuration updates in the form of a specific set of apps.

How to install and configure deployment server? 

Here's an example of a serverclass.conf with various hosts making connections and 2 different apps, a mail_server app and win_clients app. In this examples only hosts starting with the hostname of host_123 or host_456 will get the "win" app. While hosts starting with the hostname of mail will get the "mail" app.


[global]
whitelist.0=host_123*
whitelist.1=host_456*
whitelist.2=mail*
whitelist.3=host_abc*
whitelist.4=host_xyz*


[serverClass:win_clients]
whitelist.0=host_123*
whitelist.1=host_456*
blacklist.1=mail*
blacklist.2=host_abc*
blacklist.3=host_xyz*


[serverClass:win_clients:app:win]
stateOnClient=enabled
restartSplunkd = true


[serverClass:mail_servers]
whitelist.0=mail*
blacklist.0=host_123*
blacklist.1=host_456*
blacklist.2=host_abc*
blacklist.3=host_xyz*


[serverClass:mail_servers:app:mail]
stateOnClient=enabled
restartSplunkd = true


The apps directories by default will reside on the deployment server in $SPLUNK_HOME/deployment-apps, so any config files should be placed there to be deployed to clients. Once deployed on the clients they will reside on $SPLUNK_HOME/apps


Follow below  steps to enable deployment server feature on indexer or forwarder:

Understanding Serverclass.conf | deplymentclient.conf

Serverclass.conf file is the main configuration file used by deployment server to distribute updates and configuration.We need to whitelist the server for which you want configuration to be distributed and blacklist server for which  you do not want to distribute updates.

Deplymentclient.conf

Deployment.conf contains list of app repositories on different server for which we want to distribute updates.

 
Serverclass.conf example

 

Deployment client.conf example

                                                                                                                                                                                                                           < Back |Home| Next  >

Comment Box is loading comments...