show unconfigured forwarders from deployment server search

[some_guy]

We use Deployment Server for managing all our universal forwarder inputs.

I need to take an accounting of all devices, from the deployment server, where the Universal Forwarder has been installed (and phones home), but has NOT been configured (no inputs forwarding). Already using the UFMA app, but this particular search isn't jumping out at me.

Anyone got a one-liner for this? Thank you.

[manjunathmeti · Accepted solution]

This search query will give you list of client for which server class is not defined.

| rest /services/deployment/server/clients splunk_server=local | table clientName serverClasses.* | untable clientName, serverclass | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(serverclass) as cnt by clientName | where cnt = 0

This query will give you list of clients for which server class is configured but no app is configured.

| rest /services/deployment/server/clients splunk_server=local | table clientName applications.* | untable clientName, applications | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(applications) as cnt by clientName | where cnt = 0

[some_guy]

Brilliant, thank you. Ended up going with instanceName to display clients...

| rest /services/deployment/server/clients splunk_server=local | table instanceName applications.* | untable instanceName, applications | append [| rest /services/deployment/server/clients splunk_server=local | table instanceName] | stats count(applications) as cnt by instanceName | where cnt = 0