Hi, I am planning to create a dashboard. In that i need to know the servername replying to the headnode, server last update time, application that is using that server and the server platform(windows, linux.. etc). currently I am using
| metadata type=hosts | sort -recentTime | convert ctime(recentTime) as Latest_Time | table host, Latest_Time, totalCount
Can I know how it can be done.
Assuming that by "applications" you mean Splunk apps deployed from a deployment server, and your deployment server is reachable from where ever you're searching, something like this might work:
| metadata type=hosts | sort -recentTime | convert ctime(recentTime) as Latest_Time | table host, Latest_Time, totalCount
| join type=outer host [
| rest /services/deployment/server/clients
| eval apps=" "
| foreach applications.*.stateOnClient [ eval apps=if('<<FIELD>>'="enabled", apps."A"." <<MATCHSTR>>", apps) ]
| fields fields dns, utsname, apps
| rename dns as host
]
| fields host, Latest_Time, totalCount, utsname, apps