Knowledge Management

In a distrubuted environment, how to find each server Role

splunk_sa
Explorer

We have several Splunk server set up by a contractor as distributed environment. I need to identify each server role. I tried .\splunk show shcluster-status but it just gives me cluster information.
I particularly need to find Deployment server role.

My second question is what is difference between Splunk Add on for Active Directory and Splunk App for Active Directory. what are the use of these components?
thanks a lot

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

Hello splunk_sa
to find out the roles of server, you can run this command in search bar: | rest /services/server/info | table host host_fqdn server_roles
sometimes if not set properly, multiple servers will have same roles. another option is if all machines sends their data to indexer is search index = _internal and check who the clients are phoning home to. or you can look for the instance that shows clients on Forwarder Management" page. navigate to settings -> click forwarder management.
lastly, you can search for an instance that has directories (apps) in its .../etc/deployment-apps/ directory

regarding second question.
the app for AD https://splunkbase.splunk.com/app/1059/ seems like an old app that was last updated 4 years ago
the AD TA (add-on) https://splunkbase.splunk.com/app/3207/ is an app that assists in collecting AD data
some prebuilt dashboards and reports on AD data you can find in various otehr apps such as the app for Windows Infrastructure:
https://splunkbase.splunk.com/app/1680/

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

Hello splunk_sa
to find out the roles of server, you can run this command in search bar: | rest /services/server/info | table host host_fqdn server_roles
sometimes if not set properly, multiple servers will have same roles. another option is if all machines sends their data to indexer is search index = _internal and check who the clients are phoning home to. or you can look for the instance that shows clients on Forwarder Management" page. navigate to settings -> click forwarder management.
lastly, you can search for an instance that has directories (apps) in its .../etc/deployment-apps/ directory

regarding second question.
the app for AD https://splunkbase.splunk.com/app/1059/ seems like an old app that was last updated 4 years ago
the AD TA (add-on) https://splunkbase.splunk.com/app/3207/ is an app that assists in collecting AD data
some prebuilt dashboards and reports on AD data you can find in various otehr apps such as the app for Windows Infrastructure:
https://splunkbase.splunk.com/app/1680/

hope it helps

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...