![]() ![]() Note: When setting up server classes later on in the setup process, you can enter a unique name for the server class that describes the hosts that belong in the class, and that you will remember. In the "New Server Class" dialog box that pops up, enter "Universal Forwarders".In the pop-up that appears, click New Server Class.Click the gray " " sign under "Server Classes.".Splunk Enterprise loads the "Edit app: sendtoindexer" page. From the Apps tab in Forwarder Management, in the "sendtoindexer" listing under "Actions", click Edit.Later, you will add universal forwarder clients to the class. In this procedure you will create the server class, then assign the "send to indexer" app to this class. In this case, server classes tell deployment server when and where to deploy the "send to indexer" app. A server class treats a set of deployment clients as a group - any member of a server class receives apps and configurations defined within that class. Server classes are logical data structures that tell deployment servers where and what to send to one or more deployment clients. The next step is to define a server class for the "send to indexer" app. ![]() If you don't see the app, review the instructions in "Activate deployment server" and confirm that you have copied the entire "sendtoindexer" folder over to the Splunk deployment apps directory. You should see the "sendtoindexer" app in the list. In the system bar, click Settings > Forwarder Management.Once you have logged back into Splunk, confirm that deployment server has activated and is aware of the new "send to indexer" app: The indexer has now gained the deployment server capability. Open a PowerShell window and type the following:.On the indexer, use your operating system file management tools to move the "sendtoindexer" folder from the Splunk apps directory to the Splunk deployment apps directory.In this case, the app is the "send to indexer" app you created earlier, and the host is the indexer you set up initially. To activate deployment server, you must place at least one app into %SPLUNK_HOME%\etc\deployment-apps on the host you want to act as deployment server. If you want, you can use an external tool, such as Windows System Center Configuration Manager or chef, puppet, or salt if your deployment runs on *nix servers. It is not a requirement to use deployment server, however. This procedure uses deployment server to get you familiarized with the concept of using it to distribute apps and configurations quickly and efficiently. It is the most native way to get your environment up and running. Learn more at " About deployment server and forwarder management."ĭeployment server is the fastest way to get apps and configurations deployed to your Splunk universal forwarders. You accomplish this through the Forwarder Management scheme. In this setup you will use the deployment server to distribute the "send to indexer" app to all universal forwarders in the Splunk App for Windows Infrastructure deployment. Deployment server can send assets to other full Splunk Enterprise instances as well as light and universal forwarders.ĭeployment server is available on every full Splunk Enterprise instance. The Splunk Enterprise deployment server is a system that distributes apps, configurations, and other assets to other Splunk instances. This topic discusses how to set up deployment server to distribute the "send to indexer" app you created previously to all of the universal forwarders that you will set up as part of the Splunk App for Windows Infrastructure deployment. Set up a deployment server and create a server class
0 Comments
Leave a Reply. |