Deployment server reporting

[rk60422]

Has anyone figured out how to successfully join the three new _DS indexes into a meaningful report?

I would like to create a report that shows me when a UF/HF phoned home and what actions it may have performed.

[livehybrid]

If you want to see actions performed then something like this:

index=_dsappevent earliest=-24h
| table _time data.action data.appName data.clientId data.result 
| append 
    [ tstats first(data.hostname) as hostname, first(data.dns) as dns_name, first(data.ip) as ip WHERE earliest=-24h index=_dsclient by data.clientId] 
| stats values(*) as * by data.clientId
| table hostname dns_name ip *

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[richgalloway]

The Forwarder Management page in the DS will do that for you. 

If it doesn't show what you want then please tell us your use case and we can suggest something.

[livehybrid]

Hi @rk60422 

Here are some starters which might help:

List of clients (and some useful info)

|tstats first(data.hostname) as hostname, first(data.dns) as dns_name, first(data.ip) as ip, first(data.splunkVersion) as splunkVersion, first(data.package) as package WHERE index=_dsclient by data.clientId

Latest phonehome time by clientId

|tstats latest(_time) as latest_phonehome where earliest=-24h index=_dsphonehome by data.clientId | eval friendlyPhonehomeTime=strftime(latest_phonehome,"%Y-%m-%d %H:%M:%S")

These could be combined to get the last phonehome with the additional info:

| tstats latest(_time) as latest_phonehome where earliest=-24h index=_dsphonehome by data.clientId 
| eval friendlyPhonehomeTime=strftime(latest_phonehome,"%Y-%m-%d %H:%M:%S") 
| append 
    [ tstats first(data.hostname) as hostname, first(data.dns) as dns_name, first(data.ip) as ip, first(data.splunkVersion) as splunkVersion, first(data.package) as package WHERE earliest=-24h index=_dsclient by data.clientId]
    | stats values(*) as * by data.clientId

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing