We're using Splunk's deployment server to simplify inputs.conf/app configurations on our Universal Forwarders.
We're adding more servers to out environment, and the serverclass.conf file on our Deployment Servers is starting to get pretty large and complicated.
We're using wildcards on some whitelists/blacklists, which work very well since our hostnames follow a given pattern.
But that's not always enough..
We have an entire group's worth of servers (so far about 300ish) that all need the same inputs.conf configuration. Right now we're doing this by listing out all the hostnames by doing:
whitelist.0 = host1
whitelist.1 = host2
...
whitelist.99 = host100
...
whitelist.299 = host300
It's a long and growing list, and it's getting pretty difficult to keep track of.
I've put together a good bit of this list via a script I wrote to automate it's creation, but it feels like this is a bit overkill.
How is everyone else managing their serverclass.conf file when there are many of servers that need to receive a specific configuration?