The overview of agent management interface

The agent management UI is an interactive, visual tool for creating server classes, which map agents to deployment apps. You can also use agent management UI to manage and monitor your deployment.

The interface saves server class configurations to a serverclass.conf file, located under $SPLUNK_HOME/etc/system/local on agent management.

Capabilities of the interface

The main purpose of the interface is to create and edit server classes. You can also use it for other purposes:

  • Track the status of the system
  • Monitor deployment activity
  • View the associations between apps, agents, and server classes
  • Configure app behavior
  • Uninstall apps from agents

Access the interface

You access the agent management interface through Splunk Web. To open the interface:

  1. Log in to Splunk Enterprise.
  2. Select Settings and then under the Distributed Environment section select Agent management.

    The Agent management page opens.

The page contains the following section:

  • A side menu. You can switch views between Forwarders and OTel Collectors.
  • A status section, with information on agents and recent downloads.
  • Three tabs:
    • Forwarders: Lists all agents of the agent management, along with status information. You can filter this list in various ways to limit the current view.
    • Applications: Lists the set of deployment applications (apps) in the repository location, along with their statuses. In this tab, you can edit some app properties.
    • Server Classes: Lists the set of server classes, along with their statuses. From here, you can create new server classes and edit existing ones. You can also drill down on existing server classes for information on their associated apps and agents. For new, unconfigured agent management, the list will be empty.

      For more information about this page, read Use the agent management interface to define server classes.

Limitations of the interface

The interface supports the vast majority of the use cases of agent management. For some complex configuration requirements, however, you might need to edit serverclass.conf directly.

Note:

If you switch from using the interface to direct editing serverclass.conf, you might not be able to use the interface for any subsequent configuration. This is because the interface can handle only a subset of the configurations possible through serverclass.conf.

Here are some limitations of the interface, compared to the direct editing of the configuration file:

  • Deployment behavior of any app must be the same across server classes. For example, you cannot specify that an app initiate a restart on an agent when it's downloaded via one server class but not when it's downloaded via another server class.
  • You cannot modify the default repositoryLocation on agent management.
  • The filterType, which governs the combined behavior of allow lists and deny lists, must use the default value of whitelist.
  • Agent filters are only supported at the server class level.

For details about interface limitations and compatibility between the interface and the serverclass.conf file, see Compatibility and agent management UI.