Splunk® Enterprise

Updating Splunk Enterprise Instances

Use forwarder management to define server classes

The forwarder management interface is an interactive, visual tool for creating and editing server classes, which map deployment clients to deployment apps. You run it on the deployment server. For an introduction to the interface, including details on how to access it, see "Forwarder management overview".

The interface saves server class configurations to a serverclass.conf file. The first time you save a server class, forwarder management creates the serverclass.conf file under $SPLUNK_HOME/etc/system/local on the deployment server. For information on serverclass.conf, see "The serverclass.conf file".

Note: For some advanced server class configurations, you might need to directly edit serverclass.conf. For information on forwarder management limitations, see "Compatibility and forwarder management". For details on editing serverclass.conf directly, see the topic "Use serverclass.conf to define server classes".

Define a server class

A server class maps deployment clients to deployment apps. Therefore, before you define a server class, you need to configure the clients and create the apps that you intend to map. For information, read the topics "Configure deployment clients" and "Create deployment apps".

After you set up the clients and apps, they appear automatically in the forwarder management interface.

There are three steps to defining a server class:

1. Create the server class.

2. Add deployment apps to the server class.

3. Specify clients for the server class.

You can perform steps 2 and 3 in either order. You can also change the set of clients and apps at any time.

Important: Each time you use the forwarder management interface to edit and save a server class configuration, the deployment server will reload and then deploy the latest app content to any clients that haven't already received it. For example, if you add an app to the server class, all clients in the server class will then receive it. If you add some new clients to the server class but don't change the apps, only the new clients will get the distribution. For a detailed discussion of what actions prompt the deployment server to deploy or redeploy apps, read the topic "Deploy apps to clients".

1. Create the server class

To create the server class, go to the forwarder management interface, as described in "Access the forwarder management interface", and perform these actions:

1. Select the Groups / Server Classes tab.

2. Select the New Server Class button.

3. Enter a name for the server class in the Title field of the pop-up window and click Save.


This takes you to a screen with prompts for adding clients, under the Agents tab, and applications, under the Configurations tab.

Important: Server class names must be unique. Also, they cannot contain spaces.

2. Add apps

When you save a server class, the interface takes you to a screen with prompts for adding apps and clients. To add apps to the server class:

1. Select the Configurations tab.

2. Select the Edit configurations button. This takes you to the Edit Applications Assigned page. On this page, there are two columns: Unassigned applications and Assigned Applications, with a list of apps under each. For a new server class, all apps will initially be in the Unassigned column.

3. To add an apps to the server class, select them, then select the arrow titled "Move to Assigned Applications" (Arrowimag.png). This moves these apps to the Assigned Applications column.

4. After you select all the apps for the server class, click Save. If you haven't yet added any clients, you can do so now.

When you save the app settings, the deployment server reloads and deploys the apps to the set of clients, assuming you have already specified the clients for this server class. If you have yet to specify the clients, the apps will get deployed once you do.

3. Specify clients

When you save a server class, the interface takes you to a screen with prompts for adding apps and clients. To add clients to the server class:

1. Click the Agents tab. Select theEdit Agent Assignment button. The Edit Agents Assigned page appears. (You can also edit the set of clients later, by going to the Server Classes tab and clicking the Edit Agent Assignments button for the particular server class.)

On the Edit Agents Assigned page, there are three buttons, All, Matched and Unmatched, followed by a list of clients. The clients appearing when you select the All button will be the ones that you earlier configured for this deployment server, as described in "Configure deployment clients". The Matched and Unmatched buttons list clients according to whether they match the filters that you've created at the top of the page. For a new server class, no clients initially appear under the Matched tab.

2. To add clients to the server class, you do not specify them individually. Instead, you create filters that dynamically include or exclude clients. You enter the filters using the fields near the top of the page: Include, Exclude, and Filter by Machine Type. There's a lot to learn about creating client filters, and so the details are covered in a separate topic, "Set up client filters".

After you enter one or more filters, click the Preview button to view the set of matched clients.

If you have a long list of clients and you only want to view a subset of them, you can use the filter field to the right of the All/Matched/Unmatched buttons. This particular filter only limits the clients shown in the table; it does not filter the set of clients included in the server class. You can filter on the columns in the client table; for example, host name or IP address.

3. After you specify the clients you want in the server class, click Save. If you haven't yet added any apps, you can now do so.

When you save the client settings, the deployment server reloads and then deploys the set of apps for this server class to any clients that haven't already received them. It only does this if you have already specified the apps for the server class.

View a server class

To view the contents of a server class:

1. Go to the Server Classes / Groups tab on the home page for Forwarder Management. This shows you a list of all server classes on the deployment server.

2. Click on the server class you want to view. This takes you to a page for that server class. The page contains three sections:

  • "Details." This page lists the server class's reload time, architecture, and repository.
  • "Agents." This page lists the clients assigned to that server class. From here, you can also edit agent assignment.
  • "Applications." This page lists the applications assigned to the server class. From here, you can also edit configurations.

For information on managing apps, see "Use forwarder management to manage apps". For information on managing clients, see "Use forwarder management to manage clients".

Edit a server class

You can edit a server class at any time. Go to the Server Classes tab on the entry page for Forwarder Management. Locate the server class you want to edit and press the three dots (Threedots.png) in the last column for that server class. You have these choices:

  • View server class details
  • Edit agent assignment
  • Edit configurations
  • Rename
  • Delete

When you click Save after editing the set of clients or apps, the deployment server reloads and makes the latest app content available to any clients that haven't already received it.

Last modified on 17 December, 2024
Create server classes   Set up client filters

This documentation applies to the following versions of Splunk® Enterprise: 9.4.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters