topic Re: Deployment Client Query Help - How many server class are you a member of and what are they? in Deployment Architecture

Deployment Client Query Help - How many server class are you a member of and what are they?

quihong — Fri, 10 Mar 2017 17:53:50 GMT

Hello,

I'm looking for some help on reporting on the status of my deployment client for better coverage.

I know the Deployment Client data is available via rest using the following server on the Deployment Server:
"I rest /services/deployment/server/clients count=0 splunk_server=local"

However, I need some help with pulling out exactly what I need. which is the clientName, number of serverclasses the client is a member of and the names of the serverclasses (in one field).

So something like this:
clientName, NumberOfServerClasses, ServerClassNames

myServer | 3 | thisclass;thatclass;andtheotherone

Any help is greatly appreciated. Thank you

Re: Deployment Client Query Help - How many server class are you a member of and what are they?

somesoni2 — Fri, 10 Mar 2017 19:48:43 GMT

Here you go.

| rest /services/deployment/server/clients count=0 splunk_server=local  | table hostname serverClasses.*.stateOnClient 
| untable hostname ServerClassNames dummy 
| rex field=ServerClassNames "serverClasses\.(?<ServerClassNames>[^\.]+)\.stateOnClient$" 
| stats values(ServerClassNames) as ServerClassNames dc(ServerClassNames) as NumberOfServerClasses by hostname 
| rename hostname as clientName
| table clientName, NumberOfServerClasses, ServerClassNames

There will multiple columns for each server class the hostname/client belongs to. I just took one such column type, converted columns to rows, extracted server class name and ran stats. Run the query portion by portion to see what it does.

Re: Deployment Client Query Help - How many server class are you a member of and what are they?

quihong — Fri, 10 Mar 2017 20:00:17 GMT

@somesoni2, you're my SPL hero! Thank you so much.

Re: Deployment Client Query Help - How many server class are you a member of and what are they?

davidjohnbecket — Wed, 22 Aug 2018 11:43:11 GMT

Great post.

How would i get the host ip address into the end result too?