detecting a first-time connection to deployment server



Is there a way to determine when a new client connects to deployment server?

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

You can see deployment client connections using this search:

index=_internal source=*splunkd.log component=ClientSessionsManager

But, this is the _internal index, which doesn't survive much past 30 days or so, so if you want a history, you'll probably need to keep track of them yourself; maybe with a temporal lookup table you append to with results from the above search (scheduled to run periodically)?

0 Karma


For maintaining that lookup table you should take a look at

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...