Deployment Architecture

I want to map serverclasses to their apps and client whitelists, but noticed something odd.... serverclasses and applications endpoints can't really be joined.

lycollicott
Motivator

Well I thought it was odd, anyway.

I have a serverclass called "Lar Test" and it has three apps assigned to it. I just want to join a REST call to serverclasses to a REST call to applications. Sounded like a pretty simple thing to do before the long weekend, right? Just join those puppies up, right?

Now why does Splunk use three different serverclass names on the applications endpoint?

alt text

1 Solution

lycollicott
Motivator

Ok, I scrolled down my endless to-do and follow-up list this morning and came upon this forgotten little gem of a question, so I said, "Hey, it's Friday before a long weekend. Let's waste a little time on this and drink some coffee."

It was shortly after that when I realized what an incredibly stupid question this really was. I could have deleted it and tried to erase my shame from the endless internet where all things are true, but I have instead chosen to publicly confess my idiocy.

Are you ready? serverclasses is a multi-value field.

| rest /services/deployment/server/serverclasses splunk_server=deploy01 
| rename title as SC 
| search SC=lar* 
| join SC 
    [| rest /services/deployment/server/applications splunk_server=deploy01
    | rename serverclasses as SC, title as App 
    | mvexpand SC
    | search SC=lar* ]
| table SC, App, whitelist.*, blacklist.*

alt text
alt text

View solution in original post

lycollicott
Motivator

Ok, I scrolled down my endless to-do and follow-up list this morning and came upon this forgotten little gem of a question, so I said, "Hey, it's Friday before a long weekend. Let's waste a little time on this and drink some coffee."

It was shortly after that when I realized what an incredibly stupid question this really was. I could have deleted it and tried to erase my shame from the endless internet where all things are true, but I have instead chosen to publicly confess my idiocy.

Are you ready? serverclasses is a multi-value field.

| rest /services/deployment/server/serverclasses splunk_server=deploy01 
| rename title as SC 
| search SC=lar* 
| join SC 
    [| rest /services/deployment/server/applications splunk_server=deploy01
    | rename serverclasses as SC, title as App 
    | mvexpand SC
    | search SC=lar* ]
| table SC, App, whitelist.*, blacklist.*

alt text
alt text

woodcock
Esteemed Legend

You can add the bugs tag to your question.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...