Deployment Architecture

Deployment Client Query Help - How many server class are you a member of and what are they?

quihong
Path Finder

Hello,

I'm looking for some help on reporting on the status of my deployment client for better coverage.

I know the Deployment Client data is available via rest using the following server on the Deployment Server:
"I rest /services/deployment/server/clients count=0 splunk_server=local"

However, I need some help with pulling out exactly what I need. which is the clientName, number of serverclasses the client is a member of and the names of the serverclasses (in one field).

So something like this:
clientName, NumberOfServerClasses, ServerClassNames

myServer | 3 | thisclass;thatclass;andtheotherone

Any help is greatly appreciated. Thank you

0 Karma
1 Solution

somesoni2
Revered Legend

Here you go.

| rest /services/deployment/server/clients count=0 splunk_server=local  | table hostname serverClasses.*.stateOnClient 
| untable hostname ServerClassNames dummy 
| rex field=ServerClassNames "serverClasses\.(?<ServerClassNames>[^\.]+)\.stateOnClient$" 
| stats values(ServerClassNames) as ServerClassNames dc(ServerClassNames) as NumberOfServerClasses by hostname 
| rename hostname as clientName
| table clientName, NumberOfServerClasses, ServerClassNames

There will multiple columns for each server class the hostname/client belongs to. I just took one such column type, converted columns to rows, extracted server class name and ran stats. Run the query portion by portion to see what it does.

View solution in original post

davidjohnbecket
Path Finder

Great post.

How would i get the host ip address into the end result too?

0 Karma

somesoni2
Revered Legend

Here you go.

| rest /services/deployment/server/clients count=0 splunk_server=local  | table hostname serverClasses.*.stateOnClient 
| untable hostname ServerClassNames dummy 
| rex field=ServerClassNames "serverClasses\.(?<ServerClassNames>[^\.]+)\.stateOnClient$" 
| stats values(ServerClassNames) as ServerClassNames dc(ServerClassNames) as NumberOfServerClasses by hostname 
| rename hostname as clientName
| table clientName, NumberOfServerClasses, ServerClassNames

There will multiple columns for each server class the hostname/client belongs to. I just took one such column type, converted columns to rows, extracted server class name and ran stats. Run the query portion by portion to see what it does.

View solution in original post

quihong
Path Finder

@somesoni2, you're my SPL hero! Thank you so much.

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.