I am logging on to one of many Splunk Search Heads behind a load-balancer. How do I tell which one I'm on from a search, so I don't have to go in to the manager? The search needs to run properly with only lowest "user" permissions and return the hostname of the box I'm currently using to search.
Even a regular user can get the hostname by querying REST (v4.3+). There are likely other methods, but querying the logged in user information will return the hostname in the splunk_server field. Make sure to limit it to the local splunk_server to get data only from the search head.
| rest /services/authentication/users splunk_server=local | dedup splunk_server | table splunk_server
Even a regular user can get the hostname by querying REST (v4.3+). There are likely other methods, but querying the logged in user information will return the hostname in the splunk_server field. Make sure to limit it to the local splunk_server to get data only from the search head.
| rest /services/authentication/users splunk_server=local | dedup splunk_server | table splunk_server