In Splunk Enterprise, manually editing the serverclass.conf file on a Deployment Server can lead to the loss of UI edit functionality for server classes in Splunk Web.
The Deployment Server manages app distribution to Universal Forwarders and other deployment clients through server classes, which are defined in serverclass.conf. This file maps deployment clients to specific app configurations and defines filtering rules, restart behaviors, and inclusion/exclusion criteria.
When this configuration file is modified manually (outside of Splunk Web), the syntax, formatting, or logical relationships between entries may not match what Splunk Web expects. As a result, Splunk Web may no longer be able to parse or display those server classes correctly. Once this happens, administrators cannot modify deployment settings through the GUI until the configuration file is corrected or reverted to a valid state.
Other files such as deploymentclient.conf, inputs.conf, and deploymentserver.conf control client settings, data inputs, and core server parameters but do not affect the UI-driven deployment management functionality.
Therefore, Splunk explicitly warns administrators in its Deployment Server documentation to use Splunk Web or the CLI when modifying serverclass.conf, and to avoid manual editing unless fully confident in its syntax.
References (Splunk Enterprise Documentation):
• Deployment Server Overview – Managing Server Classes and App Deployment
• serverclass.conf Reference and Configuration Best Practices
• Splunk Enterprise Admin Manual – GUI Limitations After Manual Edits
• Troubleshooting Deployment Server and Serverclass Configuration Issues
