Deployment Architecture

show unconfigured forwarders from deployment server search

some_guy
Path Finder

We use Deployment Server for managing all our universal forwarder inputs.

I need to take an accounting of all devices, from the deployment server, where the Universal Forwarder has been installed (and phones home), but has NOT been configured (no inputs forwarding). Already using the UFMA app, but this particular search isn't jumping out at me.

Anyone got a one-liner for this? Thank you.

Labels (2)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

This search query will give you list of client for which server class is not defined.

| rest /services/deployment/server/clients splunk_server=local | table clientName serverClasses.* | untable clientName, serverclass | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(serverclass) as cnt by clientName | where cnt = 0

This query will give you list of clients for which server class is configured but no app is configured.

| rest /services/deployment/server/clients splunk_server=local | table clientName applications.* | untable clientName, applications | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(applications) as cnt by clientName | where cnt = 0

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

This search query will give you list of client for which server class is not defined.

| rest /services/deployment/server/clients splunk_server=local | table clientName serverClasses.* | untable clientName, serverclass | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(serverclass) as cnt by clientName | where cnt = 0

This query will give you list of clients for which server class is configured but no app is configured.

| rest /services/deployment/server/clients splunk_server=local | table clientName applications.* | untable clientName, applications | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(applications) as cnt by clientName | where cnt = 0
0 Karma

some_guy
Path Finder

Brilliant, thank you. Ended up going with instanceName to display clients...

| rest /services/deployment/server/clients splunk_server=local | table instanceName applications.* | untable instanceName, applications | append [| rest /services/deployment/server/clients splunk_server=local | table instanceName] | stats count(applications) as cnt by instanceName | where cnt = 0

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...