topic Deployment server reporting in Monitoring Splunk

Deployment server reporting

rk60422 — Tue, 08 Jul 2025 12:46:28 GMT

Has anyone figured out how to successfully join the three new _DS indexes into a meaningful report?

I would like to create a report that shows me when a UF/HF phoned home and what actions it may have performed.

Re: Deployment server reporting

livehybrid — Tue, 08 Jul 2025 13:57:06 GMT

Hi @rk60422

Here are some starters which might help:

List of clients (and some useful info)

|tstats first(data.hostname) as hostname, first(data.dns) as dns_name, first(data.ip) as ip, first(data.splunkVersion) as splunkVersion, first(data.package) as package WHERE index=_dsclient by data.clientId

Latest phonehome time by clientId

|tstats latest(_time) as latest_phonehome where earliest=-24h index=_dsphonehome by data.clientId | eval friendlyPhonehomeTime=strftime(latest_phonehome,"%Y-%m-%d %H:%M:%S")

These could be combined to get the last phonehome with the additional info:

| tstats latest(_time) as latest_phonehome where earliest=-24h index=_dsphonehome by data.clientId | eval friendlyPhonehomeTime=strftime(latest_phonehome,"%Y-%m-%d %H:%M:%S") | append [ tstats first(data.hostname) as hostname, first(data.dns) as dns_name, first(data.ip) as ip, first(data.splunkVersion) as splunkVersion, first(data.package) as package WHERE earliest=-24h index=_dsclient by data.clientId] | stats values(*) as * by data.clientId

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Deployment server reporting

richgalloway — Tue, 08 Jul 2025 13:57:58 GMT

The Forwarder Management page in the DS will do that for you.

If it doesn't show what you want then please tell us your use case and we can suggest something.

Re: Deployment server reporting

livehybrid — Tue, 08 Jul 2025 14:03:39 GMT

If you want to see actions performed then something like this:

index=_dsappevent earliest=-24h | table _time data.action data.appName data.clientId data.result | append [ tstats first(data.hostname) as hostname, first(data.dns) as dns_name, first(data.ip) as ip WHERE earliest=-24h index=_dsclient by data.clientId] | stats values(*) as * by data.clientId | table hostname dns_name ip *

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing