topic Re: How do I get a count of applications deployed to forwarders? in Getting Data In

How do I get a count of applications deployed to forwarders?

rholm01 — Thu, 29 Nov 2018 15:04:23 GMT

The Deployment Server - (Settings -> Forwarder Management) shows Host Name, Client Name, Instance Name, IP Address, Actions, Machine Type, Deployed Apps, and Phone Home. I need to get a list of Hosts that have less than 5 Deployed Apps. I found this command which does this, but I only need the count and not the application names. Also, the Deployment server does not have an option to export the forwarder list.

| rest /services/deployment/server/clients splunk_server=local| table hostname applications*.stateOnClient | untable hostname applications value | eval applications=replace(applications,"applications\.(\w+)\.stateOnClient","\1") | stats values(applications) as applications by hostname

Re: How do I get a count of applications deployed to forwarders?

rholm01 — Thu, 29 Nov 2018 15:07:40 GMT

Also, the Deployment Server - Forwarder Management does not sort on the Deployed Apps column.

Re: How do I get a count of applications deployed to forwarders?

harsmarvania57 — Thu, 29 Nov 2018 15:24:33 GMT

Hi @rholm01,

Try below query

| rest /services/deployment/server/clients splunk_server=local| table hostname applications*.stateOnClient| untable hostname applications value | eval applications=replace(applications,"applications.(.*).stateOnClient","\1") | stats count by hostname

EDIT: Updated query.

Re: How do I get a count of applications deployed to forwarders?

gcusello — Thu, 29 Nov 2018 15:24:49 GMT

Hi rholm01,
you could run a search like the following to extract all the informations from Deployment Server:

| rest splunk_server=local /services/deployment/server/clients
| table hostname ip utsname *.restartSplunkd
| eval temp=hostname."#".ip."#".utsname 
| table temp *.restartSplunkd
| eval application.NoApp.restartSplunkd=0
| untable temp apps count 
| eval Apps=if(like(apps,"app%"),mvindex(split(apps,"."),1),null()) 
| eval ServerClass=if(like(apps,"server%"),mvindex(split(apps,"."),1),null() ) 
| rex field=temp "(?<Host>.*)#(?<Host_IP>.*)#(?<Machine_Type>.*)" 
| table Host Host_IP Machine_Type Apps ServerClass 
| stats Values(*) as * dc(Apps) AS dc_apps by Host Host_IP Machine_Type
| eval Apps=if(dc_apps=1,Apps,mvindex(Apps,1,10))
| nomv Apps
| nomv ServerClass
| fillnull value="NoSC" ServerClass

I configured this search as an alert on my Deployment Server and then at the end I put an outputcsv command to write results on a CSV file, then I read it with an input so I have this information on my Search Head and I can correlate it with the other information.

Bye.
Giuseppe

Re: How do I get a count of applications deployed to forwarders?

jaxjohnny2000 — Wed, 19 Jun 2019 19:20:48 GMT

Works like a champ!!!! Love this, thank you!!!

Re: How do I get a count of applications deployed to forwarders?

MasterOogway — Tue, 03 Mar 2020 14:50:47 GMT

@harsmarvania57 - spot on search. Saweeet!

Run this on your Deployment Server.
I substituted the last lines 'hostname' and dropped in 'applications' and got a count of servers that have downloaded the Apps.

Re: How do I get a count of applications deployed to forwarders?

MasterOogway — Tue, 03 Mar 2020 14:57:24 GMT

Excellent! Runs straight out without any changes.

This gives you a table view listing each server, OS, Apps installed, and what Serverclass they belong to.
Not sure if it's possible, but it doesn't take into account if any server is 'Blacklist' in an App. THAT would be nice to know too.

Already saved it as a Report. Thank you.

Re: How do I get a count of applications deployed to forwarders?

nnimbe1 — Tue, 23 Mar 2021 10:28:37 GMT

@rholm01 Excellent, but along with this if you can add "last logs reported time for each host" then it will be excellent, because sometime host will report to deployment servers but will not send any logs...