What timerange does ./splunk list deploy-clients actually report on?

[Jason]

Since I use Deployment Server all the time, and tell all my clients to:

What timerange does ./splunk list deploy-clients actually report on? Is it machines that have checked into the Deployment Server in the past ... 30 seconds? One minute?

[MuS]

Hi piebob, I cannot decide it, because there is still no 'real' answer 😉

[piebob]

if Jason doesn't decide by the end of today, MuS shall decide!

[MuS]

Hi Jason, I will do it if you don't want to decide it 😉

[Jason]

bonus! Now I get to decide who is right...

[alacercogitatus · Accepted solution]

Actually, in testing, I found that around 2 minutes is the time range.

The results of my command watch -n 15 'date >> /opt/deploy.log && splunk list deploy-clients |grep "IPADDRESS" >> /opt/deploy.log' are found in pastebin below. I stopped the forwarder between the
11:52:55 and 11:53:10 times. I then started the forwarder after the 11:55:57 time. Also, default for phoneHomeIntervalInSecs is 60.

http://pastebin.com/rP2By1FC

UPDATE NOTE: The timeout may be dependent on your system and what configuration options you have set.

[piebob]

aaand the extra 50 points goes to Alacer!

[msettipane]

This has been verified by Splunk. It's every 2 minutes.

[Jason]

From what I understand it's 2 minutes no matter what your phoneHomeInterval is.

[Jason]

Annnd we have a winner. 2mins was verified by dev. Thanks for your testing folks, I've always wondered about this one.

[alacercogitatus]

So I reran with phoneHomeInterval = 120. After 2 minutes, the deployment server stopped reporting the client, and within 30 seconds of the drop, it came back after the client phoned home. So I'm thinking 2 minutes is about the timeout.

[MuS]

that's a nice one and we already figured that out.

Still the questions remains: what is the exact time range ' ./splunk list deploy-clients' reports on and how could this be changed? If you have phoneHomeIntervallinSecs set to 600 then you will have (with the current setting) clients that never show up...

[piebob]

i will award an extra 50 karma points for an accepted* answer to this question.
*(either the original asker accepts, or MuS says it worked 🙂 )

[MuS]

bump - would be nice to know what time range is used 😉