List of Forwarders that are Deployment Clients

Need a list of Forwarders that are talking to a Deployment Server? Try this:

index=_internal sourcetype=splunkd component=DC* Handshake | stats count by host

Additional REST query (performed on the DS) will return desired results (Thanks to Lyx for pointing this out!):

| rest /services/deployment/server/clients splunk_server=local | table hostname applications.*.serverclasses | untable hostname, applications, serverclass | rex field=applications "applications\.(?.+)\.serverclasses" | stats dc(hostname) as hostname by apps
Share This:

Leave A Comment?