Deployment Architecture

I want to map serverclasses to their apps and client whitelists, but noticed something odd.... serverclasses and applications endpoints can't really be joined.

Motivator

Well I thought it was odd, anyway.

I have a serverclass called "Lar Test" and it has three apps assigned to it. I just want to join a REST call to serverclasses to a REST call to applications. Sounded like a pretty simple thing to do before the long weekend, right? Just join those puppies up, right?

Now why does Splunk use three different serverclass names on the applications endpoint?

alt text

1 Solution

Motivator

Ok, I scrolled down my endless to-do and follow-up list this morning and came upon this forgotten little gem of a question, so I said, "Hey, it's Friday before a long weekend. Let's waste a little time on this and drink some coffee."

It was shortly after that when I realized what an incredibly stupid question this really was. I could have deleted it and tried to erase my shame from the endless internet where all things are true, but I have instead chosen to publicly confess my idiocy.

Are you ready? serverclasses is a multi-value field.

| rest /services/deployment/server/serverclasses splunk_server=deploy01 
| rename title as SC 
| search SC=lar* 
| join SC 
    [| rest /services/deployment/server/applications splunk_server=deploy01
    | rename serverclasses as SC, title as App 
    | mvexpand SC
    | search SC=lar* ]
| table SC, App, whitelist.*, blacklist.*

alt text
alt text

View solution in original post

Motivator

Ok, I scrolled down my endless to-do and follow-up list this morning and came upon this forgotten little gem of a question, so I said, "Hey, it's Friday before a long weekend. Let's waste a little time on this and drink some coffee."

It was shortly after that when I realized what an incredibly stupid question this really was. I could have deleted it and tried to erase my shame from the endless internet where all things are true, but I have instead chosen to publicly confess my idiocy.

Are you ready? serverclasses is a multi-value field.

| rest /services/deployment/server/serverclasses splunk_server=deploy01 
| rename title as SC 
| search SC=lar* 
| join SC 
    [| rest /services/deployment/server/applications splunk_server=deploy01
    | rename serverclasses as SC, title as App 
    | mvexpand SC
    | search SC=lar* ]
| table SC, App, whitelist.*, blacklist.*

alt text
alt text

View solution in original post

Esteemed Legend

You can add the bugs tag to your question.

0 Karma