Ad slot: top

SPL

List of Forwarders that are Deployment Clients

Description

Submitted by SplunkNinja

Need a list of Forwarders that are talking to a Deployment Server? Try this:
2 1
index=_internal sourcetype=splunkd component=DC* Handshake | stats count by host
Additional REST query (performed on the DS) will return desired results (Thanks to Lyx for pointing this out!):
| rest /services/deployment/server/clients splunk_server=local | table hostname applications.*.serverclasses | untable hostname, applications, serverclass | rex field=applications "applications\.(?.+)\.serverclasses" | stats dc(hostname) as hostname by apps

Comments

0 total

Be the first to comment on this SPL.

Leave a comment

You must log in to post a comment.

Ad slot: bottom