I want to map serverclasses to their apps and client whitelists, but noticed something odd.... serverclasses and applications endpoints can't really be joined.

[lycollicott]

Well I thought it was odd, anyway.

I have a serverclass called "Lar Test" and it has three apps assigned to it. I just want to join a REST call to serverclasses to a REST call to applications. Sounded like a pretty simple thing to do before the long weekend, right? Just join those puppies up, right?

Now why does Splunk use three different serverclass names on the applications endpoint?

[lycollicott · Accepted solution]

Ok, I scrolled down my endless to-do and follow-up list this morning and came upon this forgotten little gem of a question, so I said, "Hey, it's Friday before a long weekend. Let's waste a little time on this and drink some coffee."

It was shortly after that when I realized what an incredibly stupid question this really was. I could have deleted it and tried to erase my shame from the endless internet where all things are true, but I have instead chosen to publicly confess my idiocy.

Are you ready? serverclasses is a multi-value field.

| rest /services/deployment/server/serverclasses splunk_server=deploy01 
| rename title as SC 
| search SC=lar* 
| join SC 
    [| rest /services/deployment/server/applications splunk_server=deploy01
    | rename serverclasses as SC, title as App 
    | mvexpand SC
    | search SC=lar* ]
| table SC, App, whitelist.*, blacklist.*

[woodcock]

You can add the bugs tag to your question.