Monitoring Splunk

Deployment server reporting

rk60422
Explorer

Has anyone figured out how to successfully join the three new _DS indexes into a meaningful report?

I would like to create a report that shows me when a UF/HF phoned home and what actions it may have performed.

Labels (2)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

If you want to see actions performed then something like this:

index=_dsappevent earliest=-24h
| table _time data.action data.appName data.clientId data.result 
| append 
    [ tstats first(data.hostname) as hostname, first(data.dns) as dns_name, first(data.ip) as ip WHERE earliest=-24h index=_dsclient by data.clientId] 
| stats values(*) as * by data.clientId
| table hostname dns_name ip *

livehybrid_0-1751983410026.png

 

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The Forwarder Management page in the DS will do that for you. 

If it doesn't show what you want then please tell us your use case and we can suggest something.

---
If this reply helps you, Karma would be appreciated.
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @rk60422 

Here are some starters which might help:

List of clients (and some useful info)

|tstats first(data.hostname) as hostname, first(data.dns) as dns_name, first(data.ip) as ip, first(data.splunkVersion) as splunkVersion, first(data.package) as package WHERE index=_dsclient by data.clientId

Latest phonehome time by clientId

|tstats latest(_time) as latest_phonehome where earliest=-24h index=_dsphonehome by data.clientId | eval friendlyPhonehomeTime=strftime(latest_phonehome,"%Y-%m-%d %H:%M:%S")

These could be combined to get the last phonehome with the additional info:

| tstats latest(_time) as latest_phonehome where earliest=-24h index=_dsphonehome by data.clientId 
| eval friendlyPhonehomeTime=strftime(latest_phonehome,"%Y-%m-%d %H:%M:%S") 
| append 
    [ tstats first(data.hostname) as hostname, first(data.dns) as dns_name, first(data.ip) as ip, first(data.splunkVersion) as splunkVersion, first(data.package) as package WHERE earliest=-24h index=_dsclient by data.clientId]
    | stats values(*) as * by data.clientId

livehybrid_0-1751983021102.png

 

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...