Deployment Architecture

I want to map serverclasses to their apps and client whitelists, but noticed something odd.... serverclasses and applications endpoints can't really be joined.

lycollicott
Motivator

Well I thought it was odd, anyway.

I have a serverclass called "Lar Test" and it has three apps assigned to it. I just want to join a REST call to serverclasses to a REST call to applications. Sounded like a pretty simple thing to do before the long weekend, right? Just join those puppies up, right?

Now why does Splunk use three different serverclass names on the applications endpoint?

alt text

1 Solution

lycollicott
Motivator

Ok, I scrolled down my endless to-do and follow-up list this morning and came upon this forgotten little gem of a question, so I said, "Hey, it's Friday before a long weekend. Let's waste a little time on this and drink some coffee."

It was shortly after that when I realized what an incredibly stupid question this really was. I could have deleted it and tried to erase my shame from the endless internet where all things are true, but I have instead chosen to publicly confess my idiocy.

Are you ready? serverclasses is a multi-value field.

| rest /services/deployment/server/serverclasses splunk_server=deploy01 
| rename title as SC 
| search SC=lar* 
| join SC 
    [| rest /services/deployment/server/applications splunk_server=deploy01
    | rename serverclasses as SC, title as App 
    | mvexpand SC
    | search SC=lar* ]
| table SC, App, whitelist.*, blacklist.*

alt text
alt text

View solution in original post

lycollicott
Motivator

Ok, I scrolled down my endless to-do and follow-up list this morning and came upon this forgotten little gem of a question, so I said, "Hey, it's Friday before a long weekend. Let's waste a little time on this and drink some coffee."

It was shortly after that when I realized what an incredibly stupid question this really was. I could have deleted it and tried to erase my shame from the endless internet where all things are true, but I have instead chosen to publicly confess my idiocy.

Are you ready? serverclasses is a multi-value field.

| rest /services/deployment/server/serverclasses splunk_server=deploy01 
| rename title as SC 
| search SC=lar* 
| join SC 
    [| rest /services/deployment/server/applications splunk_server=deploy01
    | rename serverclasses as SC, title as App 
    | mvexpand SC
    | search SC=lar* ]
| table SC, App, whitelist.*, blacklist.*

alt text
alt text

woodcock
Esteemed Legend

You can add the bugs tag to your question.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...