Hi,
There are a lot of clients in my architecture and every other splunk instance is deployed in either /opt/bank/splunk OR /opt/insurance/splunk OR /opt/splunk
Hence I want to run a command to extract list of all clients along with the path where splunkd is running.
How can i achieve this, please suggest
This is the query that helped me get the required output.
index=_internal sourcetype=splunkd | stats count by source,host | regex source="(?:\/|\x5c)splunkd\.log$" | rex field=source "(?<installation_path>.*)(?:\/|\x5c)var(?:\/|\x5c)"
Hi @krutika_ag ,
let us know if we can help you more, or, please, accept one answer for the other people of Community.
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated by all the contributors 😉
Hi @krutika_ag ,
if these splunk servers are sending internal logs to Splunk you could use something like this:
for Windows servers:
index=_internal
| rex field=source "^(?<splunk_home>.*)Splunk"
| dedup host
| table host splunk_home
for linux servers:
index=_internal
| rex field=source "^(?<splunk_home>.*)splunk"
| dedup host
| table host splunk_home
Ciao.
Giuseppe
Where is this information coming from?