In a large cloud customer environment with many (>100) dynamically created endpoint systems, each with a UF already deployed, what is the best approach for associating these systems with an…

The correct answer is A. Work with the cloud orchestration team to create a common host-naming convention for these. Option A is correct because Splunk's deployment server can automatically assign UFs to serverclasses using whitelist/blacklist patterns that match against machine names (hostnames). By coordinating a consistent naming convention with the cloud orchestration team (e.g…

Data Ingestion and Configuration

Question

In a large cloud customer environment with many (>100) dynamically created endpoint systems, each with a UF already deployed, what is the best approach for associating these systems with an appropriate serverclass on the deployment server?

Options

AWork with the cloud orchestration team to create a common host-naming convention for these
BCreate a CSV lookup file for each severclass, manually keep track of the endpoints within this CSV
CWork with the cloud orchestration team to dynamically insert an appropriate clientName setting
DUsing an installation bootstrap script run a CLI command to assign a clientName setting and

How the community answered

(61 responses)

A
70% (43)
B
5% (3)
C
15% (9)
D
10% (6)

Explanation

Option A is correct because Splunk's deployment server can automatically assign UFs to serverclasses using whitelist/blacklist patterns that match against machine names (hostnames). By coordinating a consistent naming convention with the cloud orchestration team (e.g., prod-web-*, dev-db-*), the deployment server's serverclass.conf can use wildcard patterns to dynamically categorize every new endpoint the moment it checks in - no manual intervention required at scale.

Why the distractors are wrong:

B is wrong because manually maintaining a CSV for 100+ dynamic systems is operationally unsustainable and not a native deployment server feature for serverclass membership.
C is close but less ideal - dynamically injecting a clientName via orchestration adds an extra configuration layer to the UF itself, whereas hostname-based matching requires zero UF-side configuration.
D is wrong because using a bootstrap script to set clientName via CLI introduces a fragile dependency on script execution succeeding, and still requires per-system intervention.

Memory tip: Think "name the box, not the config" - in a dynamic cloud environment where systems come and go, the deployment server should do the work by recognizing who is connecting (hostname pattern), rather than requiring each UF to announce its identity via a manually set clientName.

Topics

#deployment server#serverclass#universal forwarder#host naming convention

Community Discussion

No community discussion yet for this question.

Full SPLK-3003 Practice