Splunk® Enterprise

Updating Splunk Enterprise Instances

Download manual as PDF

Download topic as PDF

Use forwarder management to define server classes

The forwarder management interface is an interactive, visual tool for creating and editing server classes, which map deployment clients to deployment apps. You run it on the deployment server. For an introduction to the interface, including details on how to access it, see "Forwarder management overview".

The interface saves server class configurations to a serverclass.conf file. The first time you save a server class, forwarder management creates the serverclass.conf file under $SPLUNK_HOME/etc/system/local on the deployment server. For information on serverclass.conf, see "The serverclass.conf file".

Note: For some advanced server class configurations, you might need to directly edit serverclass.conf. For information on forwarder management limitations, see "Compatibility and forwarder management". For details on editing serverclass.conf directly, see the topic "Use serverclass.conf to define server classes".

Define a server class

A server class maps deployment clients to deployment apps. Therefore, before you define a server class, you need to configure the clients and create the apps that you intend to map. For information, read the topics "Configure deployment clients" and "Create deployment apps".

After you set up the clients and apps, they appear automatically in the forwarder management interface.

There are three steps to defining a server class:

1. Create the server class.

2. Add deployment apps to the server class.

3. Specify clients for the server class.

You can perform steps 2 and 3 in either order. You can also change the set of clients and apps at any time.

Important: Each time you use the forwarder management interface to edit and save a server class configuration, the deployment server will reload and then deploy the latest app content to any clients that haven't already received it. For example, if you add an app to the server class, all clients in the server class will then receive it. If you add some new clients to the server class but don't change the apps, only the new clients will get the distribution. For a detailed discussion of what actions prompt the deployment server to deploy or redeploy apps, read the topic "Deploy apps to clients".

1. Create the server class

To create the server class, go to the forwarder management interface, as described in "Access the forwarder management interface", and perform these actions:

1. Select the Server Classes tab.

2. Select the New Server Class button.

3. Enter a name for the server class in the Title field of the pop-up window and click Save.

This takes you to a screen with prompts for adding apps and clients.

Important: Server class names must be unique. Also, they cannot contain spaces.

2. Add apps

When you save a server class, the interface takes you to a screen with prompts for adding apps and clients. To add apps to the server class:

1. Click the Add Apps button. This takes you to the Edit Apps page. (You can also edit the set of apps later, by going to the Server Classes tab and clicking the Edit button for the particular server class.)

On the Edit Apps page, there are two columns: Unselected Apps and Selected Apps, with a list of apps under each. For a new server class, all apps will initially be in the Unselected column. The apps appearing there are the ones with subdirectories in the repository location on the deployment server (by default, $SPLUNK_HOME/etc/deployment-apps), as described in "Create deployment apps".

2. To add an app to the server class, click on it. That moves it from the Unselected Apps column to the Selected Apps column.

3. After you select all the apps for the server class, click Save. If you haven't yet added any clients, you'll now be prompted to do so.

When you save the app settings, the deployment server reloads and deploys the apps to the set of clients, assuming you have already specified the clients for this server class. If you have yet to specify the clients, the apps will get deployed once you do.

3. Specify clients

When you save a server class, the interface takes you to a screen with prompts for adding apps and clients. To add clients to the server class:

1. Click the Add Clients button. (You can also edit the set of clients later, by going to the Server Classes tab and clicking the Edit button for the particular server class.) The Edit Clients page appears:

Forwarder management edit clients.png

On the Edit Clients page, there are three buttons, All, Matched and Unmatched, followed by a list of clients. The clients appearing when you select the All button will be the ones that you earlier configured for this deployment server, as described in "Configure deployment clients". The Matched and Unmatched buttons list clients according to whether they match the filters that you've created at the top of the page. For a new server class, no clients initially appear under the Matched tab.

2. To add clients to the server class, you do not specify them individually. Instead, you create filters that dynamically include or exclude clients. You enter the filters using the fields near the top of the page: Include, Exclude, and Filter by Machine Type. There's a lot to learn about creating client filters, and so the details are covered in a separate topic, "Set up client filters".

After you enter one or more filters, click the Preview button to view the set of matched clients.

If you have a long list of clients and you only want to view a subset of them, you can use the filter field to the right of the All/Matched/Unmatched buttons. This particular filter only limits the clients shown in the table; it does not filter the set of clients included in the server class. You can filter on the columns in the client table; for example, host name or IP address.

3. After you specify the clients you want in the server class, click Save. If you haven't yet added any apps, you'll now be prompted to do so.

When you save the client settings, the deployment server reloads and then deploys the set of apps for this server class to any clients that haven't already received them. It only does this if you have already specified the apps for the server class.

View a server class

To view the contents of a server class:

1. Go to the Server Classes tab on the home page for Forwarder Management. This shows you a list of all server classes on the deployment server.

2. Click on the server class you want to view. This takes you to a page for that server class. The page contains three sections:

  • Status. The top of the page lists the number of apps and clients in the server class. It also provides information on the deployment success rate.
  • Apps. The middle section lists the apps for the server class and their deployment status. From here, you can:
    • Edit the set of apps for the server class, by clicking the Edit link at the top of the list.
    • Get more information on any app, by clicking on its name.
    • Edit an app's attributes, by clicking on the app's Edit action.
  • Clients. The bottom section lists the clients for the server class, along with some information about them, including their status. From here, you can:
    • Edit the set of clients for the server class, by clicking the Edit link at the top of the list.
    • Filter the list by how recently the clients phoned home, their deployment status, or other fields in the client table.
    • Get more details about a client, by clicking on the arrow in the leftmost colummn of each row.

For information on managing apps, see "Use forwarder management to manage apps". For information on managing clients, see "Use forwarder management to manage clients".

Edit a server class

You can edit a server class at any time. Go to the Server Classes tab on the entry page for Forwarder Management. Locate the server class you want and click the Edit button for that row. You have these choices:

When you click Save after editing the set of clients or apps, the deployment server reloads and makes the latest app content available to any clients that haven't already received it.

Note: The same edit actions are available from the Edit button near the upper right corner of the individual server class page.

PREVIOUS
Create server classes
  NEXT
Set up client filters

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6


Comments

Hettervi, thank you for the comment. I will file a bug to have the documentation updated to reflect the actual behavior. Thanks for providing the helpful Splunk Answers link as well.

Andrewb splunk, Splunker
March 5, 2018

The documentation states that "forwarder management creates the serverclass.conf file under $SPLUNK_HOME/etc/system/local on the deployment server." However, this doesn't always seem to be the case. I have a deployment server where I've consistently created server classes via the GUI, but for the actual server classes, some are created under $SPLUNK_HOME/etc/system/local, and some under $SPLUNK_HOME/etc/apps/search/local.

I've found that others have the same problem as well, as seen in the following link.

https://answers.splunk.com/answers/440773/two-serverclassconf-files-now-what.html

Could you update the docs, or if this is a bug, make a fix for it?

Hettervi
March 2, 2018

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters