Deployment Architecture

Deployment Client Query Help - How many server class are you a member of and what are they?

quihong
Path Finder

Hello,

I'm looking for some help on reporting on the status of my deployment client for better coverage.

I know the Deployment Client data is available via rest using the following server on the Deployment Server:
"I rest /services/deployment/server/clients count=0 splunk_server=local"

However, I need some help with pulling out exactly what I need. which is the clientName, number of serverclasses the client is a member of and the names of the serverclasses (in one field).

So something like this:
clientName, NumberOfServerClasses, ServerClassNames

myServer | 3 | thisclass;thatclass;andtheotherone

Any help is greatly appreciated. Thank you

0 Karma
1 Solution

somesoni2
Revered Legend

Here you go.

| rest /services/deployment/server/clients count=0 splunk_server=local  | table hostname serverClasses.*.stateOnClient 
| untable hostname ServerClassNames dummy 
| rex field=ServerClassNames "serverClasses\.(?<ServerClassNames>[^\.]+)\.stateOnClient$" 
| stats values(ServerClassNames) as ServerClassNames dc(ServerClassNames) as NumberOfServerClasses by hostname 
| rename hostname as clientName
| table clientName, NumberOfServerClasses, ServerClassNames

There will multiple columns for each server class the hostname/client belongs to. I just took one such column type, converted columns to rows, extracted server class name and ran stats. Run the query portion by portion to see what it does.

View solution in original post

davidjohnbecket
Path Finder

Great post.

How would i get the host ip address into the end result too?

0 Karma

somesoni2
Revered Legend

Here you go.

| rest /services/deployment/server/clients count=0 splunk_server=local  | table hostname serverClasses.*.stateOnClient 
| untable hostname ServerClassNames dummy 
| rex field=ServerClassNames "serverClasses\.(?<ServerClassNames>[^\.]+)\.stateOnClient$" 
| stats values(ServerClassNames) as ServerClassNames dc(ServerClassNames) as NumberOfServerClasses by hostname 
| rename hostname as clientName
| table clientName, NumberOfServerClasses, ServerClassNames

There will multiple columns for each server class the hostname/client belongs to. I just took one such column type, converted columns to rows, extracted server class name and ran stats. Run the query portion by portion to see what it does.

quihong
Path Finder

@somesoni2, you're my SPL hero! Thank you so much.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...