Deployment Architecture

show unconfigured forwarders from deployment server search

some_guy
Path Finder

We use Deployment Server for managing all our universal forwarder inputs.

I need to take an accounting of all devices, from the deployment server, where the Universal Forwarder has been installed (and phones home), but has NOT been configured (no inputs forwarding). Already using the UFMA app, but this particular search isn't jumping out at me.

Anyone got a one-liner for this? Thank you.

Labels (2)
0 Karma
1 Solution

manjunathmeti
Champion

This search query will give you list of client for which server class is not defined.

| rest /services/deployment/server/clients splunk_server=local | table clientName serverClasses.* | untable clientName, serverclass | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(serverclass) as cnt by clientName | where cnt = 0

This query will give you list of clients for which server class is configured but no app is configured.

| rest /services/deployment/server/clients splunk_server=local | table clientName applications.* | untable clientName, applications | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(applications) as cnt by clientName | where cnt = 0

View solution in original post

0 Karma

manjunathmeti
Champion

This search query will give you list of client for which server class is not defined.

| rest /services/deployment/server/clients splunk_server=local | table clientName serverClasses.* | untable clientName, serverclass | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(serverclass) as cnt by clientName | where cnt = 0

This query will give you list of clients for which server class is configured but no app is configured.

| rest /services/deployment/server/clients splunk_server=local | table clientName applications.* | untable clientName, applications | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(applications) as cnt by clientName | where cnt = 0
0 Karma

some_guy
Path Finder

Brilliant, thank you. Ended up going with instanceName to display clients...

| rest /services/deployment/server/clients splunk_server=local | table instanceName applications.* | untable instanceName, applications | append [| rest /services/deployment/server/clients splunk_server=local | table instanceName] | stats count(applications) as cnt by instanceName | where cnt = 0

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...