Monitoring Splunk

Does anyone have a query that lists UF hosts by version and serverclass?

Glasses
Builder

Does anyone have a query that lists UF hosts by version and serverclass?

I need a report that provides 

host= <foo>  Splunk Version = <version num> ServerClass = <bar>

Thank you

0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @Glasses,

You can use below search. Thanks to @gcusello , I added splunkVersion to his search.

| rest splunk_server=local /services/deployment/server/clients
| table hostname ip utsname *.restartSplunkd splunkVersion
| eval temp=hostname."#".ip."#".utsname."#".splunkVersion
| table temp *.restartSplunkd splunkVersion
| eval application.NoApp.restartSplunkd=0
| untable temp apps count 
| eval Apps=if(like(apps,"app%"),mvindex(split(apps,"."),1),null()) 
| eval ServerClass=if(like(apps,"server%"),mvindex(split(apps,"."),1),null() ) 
| rex field=temp "(?<Host>.*)#(?<Host_IP>.*)#(?<Machine_Type>.*)#(?<splunkVersion>.*)" 
| table Host Host_IP Machine_Type Apps ServerClass splunkVersion
| stats Values(*) as * dc(Apps) AS dc_apps by Host Host_IP Machine_Type splunkVersion
| eval Apps=if(dc_apps=1,Apps,mvindex(Apps,1,10))
| nomv Apps
| nomv ServerClass
| fillnull value="NoSC" ServerClass
| eval dc_apps=dc_apps-1
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @Glasses,

You can use below search. Thanks to @gcusello , I added splunkVersion to his search.

| rest splunk_server=local /services/deployment/server/clients
| table hostname ip utsname *.restartSplunkd splunkVersion
| eval temp=hostname."#".ip."#".utsname."#".splunkVersion
| table temp *.restartSplunkd splunkVersion
| eval application.NoApp.restartSplunkd=0
| untable temp apps count 
| eval Apps=if(like(apps,"app%"),mvindex(split(apps,"."),1),null()) 
| eval ServerClass=if(like(apps,"server%"),mvindex(split(apps,"."),1),null() ) 
| rex field=temp "(?<Host>.*)#(?<Host_IP>.*)#(?<Machine_Type>.*)#(?<splunkVersion>.*)" 
| table Host Host_IP Machine_Type Apps ServerClass splunkVersion
| stats Values(*) as * dc(Apps) AS dc_apps by Host Host_IP Machine_Type splunkVersion
| eval Apps=if(dc_apps=1,Apps,mvindex(Apps,1,10))
| nomv Apps
| nomv ServerClass
| fillnull value="NoSC" ServerClass
| eval dc_apps=dc_apps-1
If this reply helps you an upvote and "Accept as Solution" is appreciated.

Glasses
Builder

only flaw with the query is that the app counts are not quite right, but it gets me going, thx

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...