Agent management architecture
You use agent management to distribute content and configurations (collectively called deployment apps) to agents, grouped into server classes. Deployment apps can be full-fledged apps, such as those available on Splunkbase, or they can be just simple groups of configurations.
Key elements of the architecture
An agent management is a Splunk Enterprise instance that acts as a centralized configuration manager for any number of other instances, called "agents". Any full Splunk Enterprise instance - even one indexing data locally - can act as agent management. Agent management cannot be a client of itself.
An agent is a Splunk instance remotely configured by agent management. Agents can be universal forwarders, heavy forwarders, indexers, search heads, or OTel collectors. Each agent, except OTel collectors, belongs to one or more server classes. Currently, only fleet overview functionality is available for OTel collectors.
A deployment application (app) or configuration is a set of content (including configuration files) maintained on the agent management and deployed as a unit to agents of a server class. A deployment app might consist of just a single configuration file, or it can consist of many files. Over time, an app can be updated with new content and then redeployed to its designated agents. The deployment app can be an existing Splunk Enterprise app or one developed solely to group some content for deployment purposes.
A server class is a group of agents that share one or more defined characteristics. For example, you can group all Windows agents into one server class and all Linux agents into another server class. You use server classes to map a group of agents to one or more deployment apps. By creating a server class, you are telling the agent management that a specific set of agents should receive configuration updates in the form of a specific set of apps.
How it all fits together
This diagram provides a conceptual overview of the relationship between agent management and its set of agents and server classes:
In this example, each agent is a Splunk Enterprise forwarder that belongs to two server classes, one for its OS and the other for its geographical location. The agent management maintains the list of server classes and uses those server classes to determine what content to distribute to each agent. For an example of how to implement this type of arrangement to govern the flow of content to agents, see Deploy configurations to several forwarders.
For more information on deployment apps, see Create deployment apps. For more information on server classes, see About server classes. For more information on agent, see Configure agents.