QUery to find new Deployment clients that started reporting to Deployment Server

[splunker9999]

Hi ,

We are actually migrating our environment ,as part of that thought of creating a search query which could tell new servers that started reporting to Deployment server.

Also if there is a way , we need another query to find the deployment clients that stopped reporting to deployment server in a particular day?

can someone please help us with these 2 queries.
Thanks.

[niketn]

If you have Deployment Server configured you should be able to monitor the same from Splunk Web --> Settings --> Distributed Environment --> Forwarder Management
It lists out the App (deployment app), Server Classes (Deployment classes) and Clients (Deployment Clients)

Deployment Clients Lists clients with Forwarders configured (includes Client Host Name, Client IP, Machine Types, Apps Deployed and Phoned Home duration.

it makes the following rest call

| rest /services/deployment/server/clients 

You can pipe/modify above search/results based on your needs like

| search hostname="<YourAppServers>" 
| eval TimeDiffInMin=round((now()-lastPhoneHomeTime)/60,2) 
| sort hostname 
| table hostname, TimeDiffInMin

[twinspop]

Run over 24 hours. It will show any Fwds that haven't phoned home to the DS in the last hour. Change as required.

index=_internal sourcetype=splunkd_access host="yourDS" POST /services/broker/phonehome/connection | 
rex field=uri "_(?<fwd_name>[^_]+)_(?<fwd_id>[-0-9A-Z]+)$" | 
stats latest(eval(now()-_time)) as Latest earliest(eval(now()-_time)) as Earliest by fwd_name fwd_id clientip |
rename clientip as fwd_ip |
where Latest>3600

Change the where clause to where Earliest<(12*3600) to show anything logging newly in the last 12 hours, for example.

Warning: If your hosts have underscores in their names, the rex will not return the correct hostname, but the client ID and the IP will both still function.