Deployment Architecture
Highlighted

show unconfigured forwarders from deployment server search

Path Finder

We use Deployment Server for managing all our universal forwarder inputs.

I need to take an accounting of all devices, from the deployment server, where the Universal Forwarder has been installed (and phones home), but has NOT been configured (no inputs forwarding). Already using the UFMA app, but this particular search isn't jumping out at me.

Anyone got a one-liner for this? Thank you.

0 Karma
Highlighted

Re: show unconfigured forwarders from deployment server search

Influencer

This search query will give you list of client for which server class is not defined.

| rest /services/deployment/server/clients splunk_server=local | table clientName serverClasses.* | untable clientName, serverclass | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(serverclass) as cnt by clientName | where cnt = 0

This query will give you list of clients for which server class is configured but no app is configured.

| rest /services/deployment/server/clients splunk_server=local | table clientName applications.* | untable clientName, applications | append [| rest /services/deployment/server/clients splunk_server=local | table clientName] | stats count(applications) as cnt by clientName | where cnt = 0

View solution in original post

0 Karma
Highlighted

Re: show unconfigured forwarders from deployment server search

Path Finder

Brilliant, thank you. Ended up going with instanceName to display clients...

| rest /services/deployment/server/clients splunkserver=local | table instanceName applications.* | untable instanceName, applications | append [| rest /services/deployment/server/clients splunkserver=local | table instanceName] | stats count(applications) as cnt by instanceName | where cnt = 0

0 Karma