Use the agent management interface to define server classes

The agent management interface is an interactive, visual tool for creating and editing server classes, which map agents to deployment apps. You run it on agent management. For an introduction to the interface, including details on how to access it, see Agent management UI overview.

The interface saves server class configurations to a serverclass.conf file. The first time you save a server class, the interface creates the serverclass.conf file under $SPLUNK_HOME/etc/system/local on agent management. For information on serverclass.conf, see The serverclass.conf file.

Note: For some advanced server class configurations, you might need to directly edit serverclass.conf. For information about the limitations of the interface, see Compatibility and agent management UI. For details on editing serverclass.conf directly, see the topic Use serverclass.conf to define server classes.

Define a server class

A server class maps agents to deployment apps. Therefore, before you define a server class, you need to configure the agents and create the apps that you intend to map. For more information, see Configure agents and Create deployment apps.

After you set up the agents and apps, they are displayed automatically on the interface.

Note: Each time you use the agent management interface to edit and save a server class configuration, the agent management will reload and then deploy the latest app content to any agents that haven't already received it. For example, if you add an app to the server class, all agents in the server class will then receive it. If you add some new agents to the server class but don't change the apps, only the new agents will get the distribution. For a detailed discussion of what actions prompt the agent management to deploy or redeploy apps, see Deploy apps to agents.

Create the server class

To create the server class, go to the agent management interface, as described in Access the agent management interface, and perform the following steps:

  1. On the menu on the left, select Forwarders and then select the Server Classes tab.

  2. Select the New server class button.

  3. On the Add a new server class page, in the Server class name field, enter a name for the server class and select Next.
    Note: The server class names must be unique and they cannot contain spaces.

  4. In the Assign agents to server class section, use filters to dynamically include or exclude agents. Enter filter criteria in the Include, Exclude, and Filter by Machine Type fields. For information about creating filters, see Filter agents.

    After you enter one or more filters, select the Preview button to view the set of matched agents. If you have a long list of agents and you only want to view a subset of them, you can use the filter field to the right of the All, Matched, Unmatched buttons. This particular filter only limits the agents shown in the table; it does not filter the set of agents included in the server class. You can filter on the columns in the agent table; for example, host name or IP address.

  5. Select Next.

  6. In the Assign applications to server class section, select up to 10 applications from the Unassigned Applications column.

  7. Select the right arrow (The arrow icon pointing to the right). This moves these apps to the Assigned Applications column.

  8. Select Next.

  9. In the Summary section, review the details. If you want to edit your selections, select Back. If the details are correct, select Done.

    You can now view the newly created server class, create another server class, or go to the Server Classes tab.

When you save the agent settings, agent management reloads and then deploys the set of apps for this server class to any agents that haven't already received them. It only does this if you have already specified the apps for the server class.

View a server class

To view the contents of a server class:

  1. Log in to Splunk Enterprise.
  2. Select Settings and then under the Distributed Environment section select Agent management.

    The Agent management page opens.

  3. On the menu on the left, select Forwarders and then select the Server Classes tab. The list of all server classes on the agent management is displayed.

  4. Select the server class you want to view. This takes you to a page for that server class. The page contains three tabs:
    • Details - lists the server class's reload time, architecture, and repository.
    • Forwarders - lists the agents assigned to that server class. From here, you can also edit agent assignment.
    • Applications - lists the applications assigned to the server class. From here, you can also edit configurations.

For information on managing apps, see Use agent management UI to manage apps.

For information on managing agents, see Use agent management UI to manage agents.

Edit a server class

You can edit a server class at any time.

  1. Log in to Splunk Enterprise.
  2. Select Settings and then under the Distributed Environment section select Agent management.

    The Agent management page opens.

  3. On the menu on the left, select Forwarders and then select the Server Classes tab. The list of all server classes on the agent management is displayed.

  4. Locate the server class you want to edit and select the three dots (The three dots icon) in the last column for that server class. You have the following options:
    • View details
    • Edit forwarders
    • Edit applications
    • Rename
    • Delete

When you select Save after editing the set of agents or apps, agent management reloads and makes the latest app content available to any agents that haven't already received it.