Monitoring Splunk

Does anyone have a query that lists UF hosts by version and serverclass?

Glasses
Contributor

Does anyone have a query that lists UF hosts by version and serverclass?

I need a report that provides 

host= <foo>  Splunk Version = <version num> ServerClass = <bar>

Thank you

0 Karma
1 Solution

scelikok
Champion

Hi @Glasses,

You can use below search. Thanks to @gcusello , I added splunkVersion to his search.

| rest splunk_server=local /services/deployment/server/clients
| table hostname ip utsname *.restartSplunkd splunkVersion
| eval temp=hostname."#".ip."#".utsname."#".splunkVersion
| table temp *.restartSplunkd splunkVersion
| eval application.NoApp.restartSplunkd=0
| untable temp apps count 
| eval Apps=if(like(apps,"app%"),mvindex(split(apps,"."),1),null()) 
| eval ServerClass=if(like(apps,"server%"),mvindex(split(apps,"."),1),null() ) 
| rex field=temp "(?<Host>.*)#(?<Host_IP>.*)#(?<Machine_Type>.*)#(?<splunkVersion>.*)" 
| table Host Host_IP Machine_Type Apps ServerClass splunkVersion
| stats Values(*) as * dc(Apps) AS dc_apps by Host Host_IP Machine_Type splunkVersion
| eval Apps=if(dc_apps=1,Apps,mvindex(Apps,1,10))
| nomv Apps
| nomv ServerClass
| fillnull value="NoSC" ServerClass
| eval dc_apps=dc_apps-1
If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
Champion

Hi @Glasses,

You can use below search. Thanks to @gcusello , I added splunkVersion to his search.

| rest splunk_server=local /services/deployment/server/clients
| table hostname ip utsname *.restartSplunkd splunkVersion
| eval temp=hostname."#".ip."#".utsname."#".splunkVersion
| table temp *.restartSplunkd splunkVersion
| eval application.NoApp.restartSplunkd=0
| untable temp apps count 
| eval Apps=if(like(apps,"app%"),mvindex(split(apps,"."),1),null()) 
| eval ServerClass=if(like(apps,"server%"),mvindex(split(apps,"."),1),null() ) 
| rex field=temp "(?<Host>.*)#(?<Host_IP>.*)#(?<Machine_Type>.*)#(?<splunkVersion>.*)" 
| table Host Host_IP Machine_Type Apps ServerClass splunkVersion
| stats Values(*) as * dc(Apps) AS dc_apps by Host Host_IP Machine_Type splunkVersion
| eval Apps=if(dc_apps=1,Apps,mvindex(Apps,1,10))
| nomv Apps
| nomv ServerClass
| fillnull value="NoSC" ServerClass
| eval dc_apps=dc_apps-1
If this reply helps you an upvote is appreciated.

View solution in original post

Glasses
Contributor

only flaw with the query is that the app counts are not quite right, but it gets me going, thx

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!