Reporting

detecting a first-time connection to deployment server

a212830
Champion

Hi,

Is there a way to determine when a new client connects to deployment server?

Tags (2)
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

You can see deployment client connections using this search:

index=_internal source=*splunkd.log component=ClientSessionsManager

But, this is the _internal index, which doesn't survive much past 30 days or so, so if you want a history, you'll probably need to keep track of them yourself; maybe with a temporal lookup table you append to with results from the above search (scheduled to run periodically)?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

For maintaining that lookup table you should take a look at http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...