How can I tell which Splunk server I am on, from a search? (Search head hostname)

[Jason]

I am logging on to one of many Splunk Search Heads behind a load-balancer. How do I tell which one I'm on from a search, so I don't have to go in to the manager? The search needs to run properly with only lowest "user" permissions and return the hostname of the box I'm currently using to search.

[Jason · Accepted solution]

Even a regular user can get the hostname by querying REST (v4.3+). There are likely other methods, but querying the logged in user information will return the hostname in the splunk_server field. Make sure to limit it to the local splunk_server to get data only from the search head.

| rest /services/authentication/users splunk_server=local | dedup splunk_server | table splunk_server