Splunk Enterprise

Which Splunk version each of our Splunk servers are on ?

mailtosnsolutio
Explorer

2 Question on Admin Side :

Question 1 : How many hosts are on each version of the Splunk Universal Forwarder ?

index="_internal" source="*metrics.log*" group=tcpin_connections |dedup hostname |stats count(hostname) as TotalCount by hostname , version,os  |table hostname ,version,os TotalCount

this query returning results but as confirmation need to be confirm it correct or not ??

Question 2 :  Which Splunk version each of our Splunk servers are on ?

Tried rest query but it not working as need is i need to list down all the splunk instance means (SHC,IC,Deployer, Deployment server n all)

they dont want to open Monitor console , they want to be have Custom dashboard for it

 

 

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @mailtosnsolutio,

Question 1: You should remove hostname from group by statement to show total count and there is no need dedup before stats. Adding fwdType=uf will show only UF instances.

index="_internal" source="*metrics.log*" group=tcpin_connections fwdType=uf 
| stats dc(hostname) as TotalCount by version,os

Question 2:

You can use below rest query on your monitoring console instance and collect it into a summary index. After that you will be able to query summary index on any search instance;

| rest splunk_server_group=* /services/server/info | table host server_roles version

 

If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @mailtosnsolutio,

Question 1: You should remove hostname from group by statement to show total count and there is no need dedup before stats. Adding fwdType=uf will show only UF instances.

index="_internal" source="*metrics.log*" group=tcpin_connections fwdType=uf 
| stats dc(hostname) as TotalCount by version,os

Question 2:

You can use below rest query on your monitoring console instance and collect it into a summary index. After that you will be able to query summary index on any search instance;

| rest splunk_server_group=* /services/server/info | table host server_roles version

 

If this reply helps you an upvote is appreciated.
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...