Deployment Server Overview

What do you do if you have a large number of Deployment Servers (DS) and want to separate business units into different server classes? Deployment server naming conventions can make standard whitelists and blacklists lengthy and difficult to maintain.  At the same time, you don’t want to stand up secondary DS.

One solution is to add a prefix to the clientName to each forwarder for the second business unit, followed by its normal server name:

[deployment-client]
phoneHomeIntervalInSecs = 60
clientName = bunit2_<server>

[target-broker:deploymentServer]
targetUri = xxx.xxx.xxx.xxx:8089 

Deployment Server How-To:

Make two deployment server server classes and applications (1 for Windows, 1 for Linux) to push to a subset of existing forwarders to change the clientName.

Each application should contain an executable shell/batch and a scripted input to run the script.
Example shell script:

#!/bin/bash
#dcconfig.sh
#Description: Linux shell script to update deploymentclient.conf*
#
dcname=`uname -n | cut -d. -f1`

echo [deployment-client]                   > “$SPLUNK_HOME/etc/apps/bunit2_clientname_linux/local/deploymentclient.conf”
echo phoneHomeIntervalInSecs = 60         >> “$SPLUNK_HOME/etc/apps/bunit2_clientname_linux/local/deploymentclient.conf”
echo clientName = bunit2_$dcname          >> “$SPLUNK_HOME/etc/apps/bunit2_clientname_linux/local/deploymentclient.conf”
echo                                      >> “$SPLUNK_HOME/etc/apps/bunit2_clientname_linux/local/deploymentclient.conf”
echo [target-broker:deploymentServer]     >> “$SPLUNK_HOME/etc/apps/bunit2_clientname_linux/local/deploymentclient.conf”
echo targetUri = xxx.xxx.xxx.xxx:8089     >> “$SPLUNK_HOME/etc/apps/bunit2_clientname_linux/local/deploymentclient.conf”

Create a scripted input to run the shell script once the app is deployed. Scripted input only executes one time and writes a deploymentclient.conf to the local directory of the app.

inputs.conf
[script://$SPLUNK_HOME/etc/apps/bunit2_clientname_linux/bin/dcconfig.sh]
interval = -1          #run the script only once
disabled = false 

Example batch script:

@echo off
cls
REM
REM dcconfig.bat
REM
REM Description: Windows batch file to update deploymentclient.conf config
REM
REM
echo [deployment-client]                 > “%SPLUNK_HOME%\etc\apps\bunit2_clientname_windows\local\deploymentclient.conf”
echo phoneHomeIntervalInSecs = 60       >> “%SPLUNK_HOME%\etc\apps\bunit2_clientname_windows\local\deploymentclient.conf”
echo clientName = bunit2_%COMPUTERNAME% >> “%SPLUNK_HOME%\etc\apps\bunit2_clientname_windows\local\deploymentclient.conf”
echo                                    >> “%SPLUNK_HOME%\etc\apps\bunit2_clientname_windows\local\deploymentclient.conf”
echo [target-broker:deploymentServer]   >> “%SPLUNK_HOME%\etc\apps\bunit2_clientname_windows\local\deploymentclient.conf”
echo targetUri = xxx.xxx.xxx.xxx:8089   >> “%SPLUNK_HOME%\etc\apps\bunit2_clientname_windows\local\deploymentclient.conf”

:END
echo END

Example scripted input for Windows. The scripted input only executes one time and writes a deploymentclient.conf to the local directory of the app.

[script://$SPLUNK_HOME\etc\apps\bunit2_clientname_windows\bin\dcconfig.bat]
interval = -1                              #run the script only once
disabled = false

Put the files on the Deployment Server.

***Note: Ensure the shell script/batch file have execute permissions (e.g. chmod 755) ***
$SPLUNK_HOME/etc/deployment-apps
      /bunit2_clientname_linux
             /bin/dcconfig.sh
             /local/inputs.conf
      /bunit2_clientname_windows
            /bin/dcconfig.bat
           /local/inputs.conf

• Add the apps to each of the serverclasses and flag them to restart splunkd
• Add business unit test servers (an example is “bunit2”) to the whitelist of each app in the DS to deploy

Then the clientName parameter should appear in the Forwarder Management screen in the column “Client Name” instead of the GUID.

The clientName has precedence over the actual Host Name column when whitelists and blacklists are evaluated.
This allows for a single blacklist to exclude all servers from a particular server class once the clientName is in place (e.g. bunit2*).

*** Important: To actually SEE the client name show up, you may need to reload or restart the DS or choose “Delete Record”. *** 
*** Next time the forwarder checks in, it should have the client name instead of the GUID.***

Deployment Server Summary

Now you know what to do if you have a large number of Deployment Servers and want to separate business units into different server classes. Deployment server naming conventions can make standard whitelists and blacklists lengthy and difficult to maintain.  At the same time, you don’t want to stand up a secondary DS.

We’ve shown you one solution – add a prefix to the clientName to each forwarder for the second business unit, followed by its normal server name.

If you would like help with this process, feel free to contact us.

About SP6

SP6 is a Splunk consulting firm focused on Splunk professional services, including Splunk deployment, ongoing Splunk administration, and Splunk development. SP6 has a separate division that also offers Splunk recruitment and the placement of Splunk professionals into direct-hire (FTE) roles for those companies that may require assistance with acquiring their own full-time staff, given the challenge that currently exists in the market today.