Deployment Client Query Help - How many server class are you a member of and what are they?

[quihong]

Hello,

I'm looking for some help on reporting on the status of my deployment client for better coverage.

I know the Deployment Client data is available via rest using the following server on the Deployment Server:
"I rest /services/deployment/server/clients count=0 splunk_server=local"

However, I need some help with pulling out exactly what I need. which is the clientName, number of serverclasses the client is a member of and the names of the serverclasses (in one field).

So something like this:
clientName, NumberOfServerClasses, ServerClassNames

myServer | 3 | thisclass;thatclass;andtheotherone

Any help is greatly appreciated. Thank you

[davidjohnbecket]

Great post.

How would i get the host ip address into the end result too?

[somesoni2 · Accepted solution]

Here you go.

| rest /services/deployment/server/clients count=0 splunk_server=local  | table hostname serverClasses.*.stateOnClient 
| untable hostname ServerClassNames dummy 
| rex field=ServerClassNames "serverClasses\.(?<ServerClassNames>[^\.]+)\.stateOnClient$" 
| stats values(ServerClassNames) as ServerClassNames dc(ServerClassNames) as NumberOfServerClasses by hostname 
| rename hostname as clientName
| table clientName, NumberOfServerClasses, ServerClassNames

There will multiple columns for each server class the hostname/client belongs to. I just took one such column type, converted columns to rows, extracted server class name and ran stats. Run the query portion by portion to see what it does.

[quihong]

@somesoni2, you're my SPL hero! Thank you so much.