Splunk® Enterprise

Distributed Deployment Manual

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Configure deployment clients

This topic explains how to set up deployment clients to receive content from a deployment server. Each deployment client belongs to one or more server classes. Server classes define what content a deployment client should download, based on qualifying criteria.

Two configuration files control this process:

You can view deployment client settings in Splunk Manager. Go to Splunk Manager > Deployment and select the Deployment client row.

For information about configuration files, including an explanation of their basic structure, see About configuration files in the Admin manual.

The next section provides a reference for the deployment client configuration settings. You might want to read it while referring to the set of simple example configurations presented later in this topic. In addition, there are several longer and more complete examples in later topics in this manual, including "Deploy several forwarders".

Important: Although a deployment server can be a deployment client of another deployment server, it cannot be a deployment client of itself.

Enable a deployment client

To enable a Splunk instance as a deployment client, create a deploymentclient.conf file in $SPLUNK_HOME/etc/system/local.

Important: Do not use the deployment server to push deploymentclient.conf updates to the deployment clients. Doing so can potentially lead to situations where the deployment clients lose their ability to contact the deployment server.

You can also enable a deployment client through the CLI. See "Enable and disable deployment clients using the CLI", later in this topic.

The deploymentclient.conf file provides two stanzas:

Stanza Meaning
[deployment-client] Includes a number of configuration attributes, including where to find new or updated content. The default values for this stanza usually work fine.
[target-broker:deploymentServer] Specifies the location of this client's deployment server. deploymentServer is the default name for a deployment server. This is the most important configuration for this file.

These are the main attributes available in the [deployment-client] stanza:

Attribute What it's for Default
disabled Set to true or false. If true, it disables the deployment client. false
clientName A name the deployment server can use to filter on. It takes precedence over hostnames. deploymentClient
workingDir A temporary folder used by the deployment client to download server classes and applications. $SPLUNK_HOME/var/run/deploy-client
repositoryLocation The repository location where deployment apps are installed after being downloaded from a deployment server.

Apps must be installed in the default location ($SPLUNK_HOME/etc/apps) or Splunk will be unable to recognize them.

Settings defined in serverclass.conf on the deployment server can also specify a repository location for a deployment client. The deployment client uses its serverRepositoryLocationPolicy attribute to determine which setting to use.

serverRepositoryLocationPolicy Set to one of these values:
  • acceptSplunkHome - Accept the repository location supplied by the deployment server, if and only if it is rooted by $SPLUNK_HOME.
  • acceptAlways - Always accept the repository location supplied by the deployment server.
  • rejectAlways - Always reject the server-supplied repository location. Instead, use the repositoryLocation specified in this configuration file.
endpoint The HTTP endpoint from which content should be downloaded.

Note: The deployment server can specify a different endpoint from which to download each set of content (individual apps, etc). The deployment client uses the serverEndpointPolicy attribute to determine which value to use.

$deploymentServerUri$ resolves to targetUri, defined in the [target-broker] stanza.

$serviceClassName$ and $appName$ mean what they say.

serverEndpointPolicy Set to one of these values:
  • acceptAlways - Always accept the endpoint supplied by the deployment server.
  • rejectAlways - Always reject the endpoint supplied by the deployment server. Instead, use the endpoint defined by the endpoint attribute.
phoneHomeIntervalInSecs A number that determines how frequently the deployment client should check for new content. 60

In the [target-broker:deploymentServer] stanza,you specify the deployment server for this client:

Attribute What it's for Default
targetUri Set to <Deployment_server_URI>:<Mgmt_port>. Specifies the deployment server connection information. The management port is typically 8089. n/a

Note: For a complete list of attribute values, see the deploymentclient.conf specification file in the Admin manual.


Here are several examples of defining deployment clients through the deploymentclient.conf file:

# Example 1
# Deployment client receives apps, placing them into the same repositoryLocation locally,
# relative to $SPLUNK_HOME, that it picked them up from - typically $SPLUNK_HOME/etc/apps. 
# There is nothing in [deployment-client], because the deployment client is not overriding 
# the location value set on the deployment server side.


targetUri= deploymentserver.splunk.mycompany.com:8089

# Example 2
# Deployment server keeps apps to be deployed in a non-standard location on the server side 
# (perhaps for organizational purposes). 
# Deployment client receives apps and places them in the standard location. 
# This configuration rejects any location specified by the deployment server and replaces 
# it with the standard client-side location. 

serverRepositoryLocationPolicy = rejectAlways
repositoryLocation = $SPLUNK_HOME/etc/apps

targetUri= deploymentserver.splunk.mycompany.com:8089

# Example 3
# Deployment client should get apps from an HTTP server that is different from the one 
# specified by the deployment server. 

serverEndpointPolicy = rejectAlways
endpoint = http://apache.mycompany.server:8080/$serviceClassName$/$appName$.tar

targetUri= deploymentserver.splunk.mycompany.com:8089

# Example 4
# Deployment client should get apps from a location on the file system and not from a 
# location specified by the deployment server.

serverEndpointPolicy = rejectAlways
endpoint = file:/<some_mount_point>/$serviceClassName$/$appName$.tar

targetUri= deploymentserver.splunk.mycompany.com:8089

Enable and disable deployment clients using the CLI

To enable a Splunk instance as a deployment client, run this command on the client:

splunk set deploy-poll <IP address/hostname>:<port>

You specify the IP address/hostname and management port of the deployment server you want the client to connect with.

You must restart the deployment client for the change to take effect.

To disable a deployment client, run this command on the deployment client:

splunk disable deploy-client

Plan a deployment
Define server classes

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters