I used to periodically query the REST API using the search app in Splunk Web, something like so:
| rest /services/deployment/server/clients/ | rename hostname as host utsname as os | table host os
I've recently upgraded Splunk Enterprise from 6.4.3 to 6.5.3 and have now noticed that the above search yields no results. Does anyone know what may have changed that has caused this REST command to no longer function?
try this rest command for starters:
| rest /services/deployment/server/clients/
check the correct field names!
looks like the rest of your command has some typos in it:
... | rename hostname as host **utsname** as os | table host os
... | rename <field1> as 1, <field2> as 2, ... <fieldN> as N | table 1 2 ... N
you can take it from here
hope it helps
Are you running this on your Deployment server?
| Rest is now running by default only on the local server
| rest /services/deployment/server/clients/ splunk_server=* | rename hostname as host utsname as os | table host os
That was it! Had to add splunk_server=* to my SPL query for this to work. Thank you!