Servername and application.

[SridharS]

Hi, I am planning to create a dashboard. In that i need to know the servername replying to the headnode, server last update time, application that is using that server and the server platform(windows, linux.. etc). currently I am using

  | metadata type=hosts | sort -recentTime | convert ctime(recentTime) as Latest_Time | table host, Latest_Time, totalCount

Can I know how it can be done.

[mlf]

Assuming that by "applications" you mean Splunk apps deployed from a deployment server, and your deployment server is reachable from where ever you're searching, something like this might work:

| metadata type=hosts | sort -recentTime | convert ctime(recentTime) as Latest_Time | table host, Latest_Time, totalCount 
| join type=outer host [ 
   | rest /services/deployment/server/clients 
   | eval apps=" "
   | foreach applications.*.stateOnClient [ eval apps=if('<<FIELD>>'="enabled", apps."A"." <<MATCHSTR>>", apps) ] 
   | fields fields dns, utsname, apps 
   | rename dns as host 
] 
| fields host, Latest_Time, totalCount, utsname, apps