Deployment Architecture

Deployment Client Query Help - How many server class are you a member of and what are they?

quihong
Path Finder

Hello,

I'm looking for some help on reporting on the status of my deployment client for better coverage.

I know the Deployment Client data is available via rest using the following server on the Deployment Server:
"I rest /services/deployment/server/clients count=0 splunk_server=local"

However, I need some help with pulling out exactly what I need. which is the clientName, number of serverclasses the client is a member of and the names of the serverclasses (in one field).

So something like this:
clientName, NumberOfServerClasses, ServerClassNames

myServer | 3 | thisclass;thatclass;andtheotherone

Any help is greatly appreciated. Thank you

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Here you go.

| rest /services/deployment/server/clients count=0 splunk_server=local  | table hostname serverClasses.*.stateOnClient 
| untable hostname ServerClassNames dummy 
| rex field=ServerClassNames "serverClasses\.(?<ServerClassNames>[^\.]+)\.stateOnClient$" 
| stats values(ServerClassNames) as ServerClassNames dc(ServerClassNames) as NumberOfServerClasses by hostname 
| rename hostname as clientName
| table clientName, NumberOfServerClasses, ServerClassNames

There will multiple columns for each server class the hostname/client belongs to. I just took one such column type, converted columns to rows, extracted server class name and ran stats. Run the query portion by portion to see what it does.

View solution in original post

davidjohnbecket
Path Finder

Great post.

How would i get the host ip address into the end result too?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Here you go.

| rest /services/deployment/server/clients count=0 splunk_server=local  | table hostname serverClasses.*.stateOnClient 
| untable hostname ServerClassNames dummy 
| rex field=ServerClassNames "serverClasses\.(?<ServerClassNames>[^\.]+)\.stateOnClient$" 
| stats values(ServerClassNames) as ServerClassNames dc(ServerClassNames) as NumberOfServerClasses by hostname 
| rename hostname as clientName
| table clientName, NumberOfServerClasses, ServerClassNames

There will multiple columns for each server class the hostname/client belongs to. I just took one such column type, converted columns to rows, extracted server class name and ran stats. Run the query portion by portion to see what it does.

quihong
Path Finder

@somesoni2, you're my SPL hero! Thank you so much.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...