Deployment Architecture

show unconfigured forwarders from deployment server search

some_guy
Path Finder

We use Deployment Server for managing all our universal forwarder inputs.

I need to take an accounting of all devices, from the deployment server, where the Universal Forwarder has been installed (and phones home), but has NOT been configured (no inputs forwarding). Already using the UFMA app, but this particular search isn't jumping out at me.

Anyone got a one-liner for this? Thank you.

Labels (2)
0 Karma
1 Solution

manjunathmeti
Champion

This search query will give you list of client for which server class is not defined.

| rest /services/deployment/server/clients splunk_server=local | table clientName serverClasses.* | untable clientName, serverclass | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(serverclass) as cnt by clientName | where cnt = 0

This query will give you list of clients for which server class is configured but no app is configured.

| rest /services/deployment/server/clients splunk_server=local | table clientName applications.* | untable clientName, applications | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(applications) as cnt by clientName | where cnt = 0

View solution in original post

0 Karma

manjunathmeti
Champion

This search query will give you list of client for which server class is not defined.

| rest /services/deployment/server/clients splunk_server=local | table clientName serverClasses.* | untable clientName, serverclass | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(serverclass) as cnt by clientName | where cnt = 0

This query will give you list of clients for which server class is configured but no app is configured.

| rest /services/deployment/server/clients splunk_server=local | table clientName applications.* | untable clientName, applications | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(applications) as cnt by clientName | where cnt = 0
0 Karma

some_guy
Path Finder

Brilliant, thank you. Ended up going with instanceName to display clients...

| rest /services/deployment/server/clients splunk_server=local | table instanceName applications.* | untable instanceName, applications | append [| rest /services/deployment/server/clients splunk_server=local | table instanceName] | stats count(applications) as cnt by instanceName | where cnt = 0

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...