Hello,
I'm looking for some help on reporting on the status of my deployment client for better coverage.
I know the Deployment Client data is available via rest using the following server on the Deployment Server:
"I rest /services/deployment/server/clients count=0 splunk_server=local"
However, I need some help with pulling out exactly what I need. which is the clientName, number of serverclasses the client is a member of and the names of the serverclasses (in one field).
So something like this:
clientName, NumberOfServerClasses, ServerClassNames
myServer | 3 | thisclass;thatclass;andtheotherone
Any help is greatly appreciated. Thank you
Here you go.
| rest /services/deployment/server/clients count=0 splunk_server=local | table hostname serverClasses.*.stateOnClient
| untable hostname ServerClassNames dummy
| rex field=ServerClassNames "serverClasses\.(?<ServerClassNames>[^\.]+)\.stateOnClient$"
| stats values(ServerClassNames) as ServerClassNames dc(ServerClassNames) as NumberOfServerClasses by hostname
| rename hostname as clientName
| table clientName, NumberOfServerClasses, ServerClassNames
There will multiple columns for each server class the hostname/client belongs to. I just took one such column type, converted columns to rows, extracted server class name and ran stats. Run the query portion by portion to see what it does.
Great post.
How would i get the host ip address into the end result too?
Here you go.
| rest /services/deployment/server/clients count=0 splunk_server=local | table hostname serverClasses.*.stateOnClient
| untable hostname ServerClassNames dummy
| rex field=ServerClassNames "serverClasses\.(?<ServerClassNames>[^\.]+)\.stateOnClient$"
| stats values(ServerClassNames) as ServerClassNames dc(ServerClassNames) as NumberOfServerClasses by hostname
| rename hostname as clientName
| table clientName, NumberOfServerClasses, ServerClassNames
There will multiple columns for each server class the hostname/client belongs to. I just took one such column type, converted columns to rows, extracted server class name and ran stats. Run the query portion by portion to see what it does.
@somesoni2, you're my SPL hero! Thank you so much.