detecting a first-time connection to deployment server

[a212830]

Hi,

Is there a way to determine when a new client connects to deployment server?

[s2_splunk]

You can see deployment client connections using this search:

index=_internal source=*splunkd.log component=ClientSessionsManager

But, this is the _internal index, which doesn't survive much past 30 days or so, so if you want a history, you'll probably need to keep track of them yourself; maybe with a temporal lookup table you append to with results from the above search (scheduled to run periodically)?

[martin_mueller]

For maintaining that lookup table you should take a look at http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/