Splunk Enterprise

How to use btool command to find serverclass details for particular host mapped which app?

Hemnaath
Motivator

HI All,

I am looking for host mapped to a list of app in the serverclass using the btool command but unfortunately I am unable  to get details.

 

./splunk cmd btool serverclass list --app="test-fwd-p" --debug | grep -i "testhost*"  

 

Please correct me if the above syntax is in correct. 

Labels (1)
Tags (2)
0 Karma

diogofgm
SplunkTrust
SplunkTrust

You can get that information using Splunk's REST API with a search in the DS. Just change YOUR_HOST_NAME with your host name. you can throw a * in the end in case that host is presenting itself to the DS with the domain name.

| rest splunk_server=local /services/deployment/server/clients/ 
| fields name dns 
| search dns="YOUR_HOST_NAME*" 
| fields name dns 
| map search="
| rest splunk_server=local /services/deployment/server/applications/ 
| fields serverclasses* title 
| mvexpand serverclasses 
| search 
    [| rest splunk_server=local /services/deployment/server/clients/$name$ 
    | fieldsummary 
    | rex field=field "serverClasses\.(?<serverclasses>.*)\.\w+" 
    | fields serverclasses
    | dedup serverclasses ]
    | eval dns=$dns$" 
| fields dns serverclasses title

 

------------
Hope I was able to help you. If so, some karma would be appreciated.

Hemnaath
Motivator

Hey can I run this restapi query from my DMC, as I don't have DS gui access enabled. So when I run this query I am not getting any result. 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

You must 1st add your DS as peers to your MC. Then you can run this with changing splunk_server=local to splunk_server=<your DS name>

r. Ismo

isoutamo
SplunkTrust
SplunkTrust

Hi

when you are using. --app on btool it's using this app as defining precedence of config files like preferring this app. 

If I have understood right there is no way to get this information easily with btool. The best way to get this is planning things beforehand and using naming schema for server classes, apps and clients. I'm not sure if you could found that information from DS's $SPLUNK_HOME/var/run/serverclass.xml?

Some blog posts which are good to read:

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...