Configure deployment clients

Configure deployment clients

Before you configure deployment clients, determine whether you are using polling or multicast. Also, make a map of server classes. A server class map includes which configuration files and clients belong to each class. Learn more about server classes by reading this page.

Note: The Splunk desktop configuration (available in version 3.4 and later) disables deployment server functionality, but supports running as a deployment client. To run the Splunk deployment server, you must disable the desktop configuration app. Refer to the topic about the Splunk desktop app for more information.

Next, install Splunk on each client machine and configure it as a deployment client.

• Do a normal Splunk install.
  • You can run a script to install Splunk on each machine.
• Enable clients with the instructions below.
  • Follow either polling or multicast, depending on which you have chosen.
  • Set up clients via the CLI or deployment.conf

If you are uncertain if a previously installed client is currently enabled or disabled, check the deployment.conf file for disabled = <true/false>.

Enable/disable clients via the CLI

To use Splunk's CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. You can also add Splunk to your path and use the splunk command.

Note: Use only one of the following methods. The method for the client must match the server's.

polling

With polling enabled, deployment clients check for configurations from the deployment server and pull configurations as needed.

Run the following command from the Splunk CLI on each client:

./splunk set deploy-poll x.x.x.x:pppp

Substitute the IP and management port of the deployment server (the management port is typically 8089).

Disable clients with the following command:

./splunk disable deploy-client

multicast

Deployment clients set with multicast receive notice of configurations from the deployment server.

Run the following command from the Splunk CLI on each client:

./splunk set deploy-multicast x.x.x.x:pppp

Substitute the multicast group IP/Port.

Disable clients with the following command:

./splunk disable deploy-client

Enable clients via deployment.conf

Alternately, configure clients via deployment.conf. Create a deployment.conf file in $SPLUNK_HOME/etc/system/local/ or your custom configuration directory.

Note: Use only one of the following methods. The method for the client must match the server's.

multicast

[deployment-client]
multicastUri = <IP:Port, IP2:Port2, etc>
mcastInterfaceIp = <IP Address>
disabled = <true/false>

multicastUri = <IP:Port, IP2:Port2, etc>

• A comma-separated list of multicast addresses for deployment server instructions.
• Each deployment server needs to be in control over a unique set of server classes.
• Typically there is one entry in this list, or it is left blank.

mcastInterfaceIp = <IP Address>

• Use the physical interface bound to this IP address to listen to muliticasts.
• Only set this if using multicast.

disabled = <true/false>

• Turn the client on or off.

polling

[deployment-client]
deploymentServerUri = <IP:Port, IP2:Port2, etc>
pollingFrequency = <integer>
maxBackoff = <integer>
serverClasses = <comma separated list>
disabled = <true/false>

deploymentServerUri = <IP:Port, IP2:Port2, etc>

• List of deployment servers to poll.

pollingFrequency = <integer>

• Optional setting.
• How often (in seconds) to poll each deployment server listed in 'deploymentServerUri'.
• Only used if deploymentServerUri is specified.
• Defaults to 60 seconds.

maxBackoff = <integer>

• Back off polling the deployment server at a random number between 0 and <integer> (in seconds).
• The more deployment clients controlled by a single deployment server, the higher this number should be.
• maxBackoff effectively "smooths" the number of concurrent requests on the server.
• Defaults to 15 seconds.

serverClasses = <comma separated list>

• Optional setting.
• List of server classes that this deployment client is a member of.
• Usually set on the server side, under [distributedDeployment-classMaps].
• If not set on the server side, specify membership here.

disabled = <true/false>

• Turn the client on or off.

Example

Here are two different example deployment.conf files. Configure your deployment.conf and place it in $SPLUNK_HOME/etc/system/local/ or your own custom configuration directory (on the client side).

multicast

Here's a basic config, enabled for multicast:

[deployment-client]
multicastUri=225.0.0.39:9999

polling

Here's a config, enabled for polling:

[deployment-client]
deploymentServerUri = 72.28.11.182:8089
pollingFrequency = 15

• Was this topic useful?
• Post a comment