I know this has been probably asked before, but I didn't found an answer yet.
Is there any way to know which are all the Splunk Servers (Search Heads, Indexers, Deployment Server, Master Node etc..) in a distributed environment with a REST call made via SPL? It would be grateful if the query does not have to be run from the Server instance where the Monitoring Console is enabled.
Basically I would need to have the same result you can get clicking on "Instances" in the Monitoring Console.
Thanks a lot,
Edoardo
This is what the MC uses:
| rest splunk_server_group=* splunk_server_group="*" /services/server/status
you can remove the first two parms if not running on the MC and it will return everything.
HTH
Chris
Thanks for your feedback.
Do you think that from the Search Head, with the SPL rest command, is it possible to perform a rest call to the Monitoring console to get the values showed on "Instances" view?
Thank you, I know how to do a SPL REST call, the point is that I don't know which is (or which are) the REST calls to be done to list all the servers within a Splunk deployment
In the meanwhile I found this, if executed from the Monitoring Console it reports all the Splunk Servers:
| rest /services/server/status count=0 splunk_server=* | dedup splunk_server | table splunk_server
Now need to check if the same REST call can be done from the Search Head to the Monitoring Console (that in my deployment is in a different server).
As @richgalloway said you couldn’t get that information with REST. I propose to you to look this guide https://docs.splunk.com/Documentation/Splunk/8.0.4/InheritedDeployment/Introduction to get more information about your environment.
r. Ismo
Thank you for the very useful documentation, I'll keep in mind. Unfortunately it does not solve my problem