Configure deployment clients

Configure deployment clients

Before you configure deployment clients, determine whether you are using polling or multicast. Also, make a map of server classes. A server class map includes which configuration files and clients belong to each class. Learn more about server classes by reading this page.

Next, install Splunk on each client machine and configure it as a deployment client.

• Do a normal Splunk install.
  • You can run a script to install Splunk on each machine.
• Enable clients with the instructions below.
  • Follow either polling or multicast, depending on which you have chosen.
  • Set up clients via the CLI or deployment.conf

Enable clients via the CLI

To use Splunk's CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. You can also add Splunk to your path and use the splunk command.

Note: Use only one of the following methods. The method for the client must match the server's.

polling

With polling enabled, deployment clients check for configurations from the deployment server and pull configurations as needed.

Run the following command from the Splunk CLI on each client:

./splunk set deploy-poll x.x.x.x:pppp

Substitute the IP and management port of the deployment server (the management port is typically 8089).

multicast

Deployment clients set with multicast receive notice of configurations from the deployment server.

Run the following command from the Splunk CLI on each client:

./splunk set deploy-multicast x.x.x.x:pppp

Substitute the multicast group IP/Port.

Enable clients via deployment.conf

Alternately, configure clients via deployment.conf. Create a deployment.conf file in $SPLUNK_HOME/etc/bundles/local/ or your custom bundle directory.

Note: Use only one of the following methods. The method for the client must match the server's.

multicast

[deployment-client]
multicastUri = <IP:Port, IP2:Port2, etc>
mcastInterfaceIp = <IP Address>

multicastUri = <IP:Port, IP2:Port2, etc>

• A comma-separated list of multicast addresses for deployment server instructions.
• Each deployment server needs to be in control over a unique set of server classes.
• Typically there is one entry in this list, or it is left blank.

mcastInterfaceIp = <IP Address>

• Use the physical interface bound to this IP address to listen to muliticasts.
• Only set this if using multicast.

polling

[deployment-client]
deploymentServerUri = <IP:Port, IP2:Port2, etc>
pollingFrequency = <integer>
maxBackoff = <integer>
serverClasses = <comma separated list>

deploymentServerUri = <IP:Port, IP2:Port2, etc>

• List of deployment servers to poll.

pollingFrequency = <integer>

• Optional setting.
• How often (in seconds) to poll each deployment server listed in 'deploymentServerUri'.
• Only used if deploymentServerUri is specified.
• Defaults to 60 seconds.

maxBackoff = <integer>

• Back off polling the deployment server at a random number between 0 and <integer> (in seconds).
• The more deployment clients controlled by a single deployment server, the higher this number should be.
• maxBackoff effectively "smooths" the number of concurrent requests on the server.
• Defaults to 15 seconds.

serverClasses = <comma separated list>

• Optional setting.
• List of server classes that this deployment client is a member of.
• Usually set on the server side, under [distributedDeployment-classMaps].
• If not set on the server side, specify membership here.

Example

Here are two different example deployment.conf files. Configure your deployment.conf and place it in $SPLUNK_HOME/etc/bundles/local/ or your own custom bundle directory (on the client side).

multicast

Here's a basic config, enabled for multicast:

[deployment-client]
multicastUri=225.0.0.39.9999

polling

Here's a config, enabled for polling:

[deployment-client]
deploymentServerUri = 72.28.11.182:8089
pollingFrequency = 15

• Was this topic useful?
• Post a comment