SPL
List of Forwarders that are Deployment Clients
Description
Need a list of Forwarders that are talking to a Deployment Server? Try this:
2 1
index=_internal sourcetype=splunkd component=DC* Handshake | stats count by hostAdditional REST query (performed on the DS) will return desired results (Thanks to Lyx for pointing this out!):
| rest /services/deployment/server/clients splunk_server=local | table hostname applications.*.serverclasses | untable hostname, applications, serverclass | rex field=applications "applications\.(?.+)\.serverclasses" | stats dc(hostname) as hostname by apps
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.