detecting a first-time connection to deployment server



Is there a way to determine when a new client connects to deployment server?

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

You can see deployment client connections using this search:

index=_internal source=*splunkd.log component=ClientSessionsManager

But, this is the _internal index, which doesn't survive much past 30 days or so, so if you want a history, you'll probably need to keep track of them yourself; maybe with a temporal lookup table you append to with results from the above search (scheduled to run periodically)?

0 Karma


For maintaining that lookup table you should take a look at

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...