topic Re: detecting a first-time connection to deployment server in Reporting

detecting a first-time connection to deployment server

a212830 — Mon, 23 Jun 2014 23:46:16 GMT

Hi,

Is there a way to determine when a new client connects to deployment server?

Re: detecting a first-time connection to deployment server

s2_splunk — Tue, 24 Jun 2014 03:50:41 GMT

You can see deployment client connections using this search:

index=_internal source=*splunkd.log component=ClientSessionsManager

But, this is the _internal index, which doesn't survive much past 30 days or so, so if you want a history, you'll probably need to keep track of them yourself; maybe with a temporal lookup table you append to with results from the above search (scheduled to run periodically)?

Re: detecting a first-time connection to deployment server

martin_mueller — Tue, 24 Jun 2014 12:07:53 GMT

For maintaining that lookup table you should take a look at http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/