Splunk Search

QUery to find new Deployment clients that started reporting to Deployment Server

splunker9999
Path Finder

Hi ,

We are actually migrating our environment ,as part of that thought of creating a search query which could tell new servers that started reporting to Deployment server.

Also if there is a way , we need another query to find the deployment clients that stopped reporting to deployment server in a particular day?

can someone please help us with these 2 queries.
Thanks.

Tags (1)
0 Karma

niketn
Legend

If you have Deployment Server configured you should be able to monitor the same from Splunk Web --> Settings --> Distributed Environment --> Forwarder Management
It lists out the App (deployment app), Server Classes (Deployment classes) and Clients (Deployment Clients)

Deployment Clients Lists clients with Forwarders configured (includes Client Host Name, Client IP, Machine Types, Apps Deployed and Phoned Home duration.

it makes the following rest call

| rest /services/deployment/server/clients 

You can pipe/modify above search/results based on your needs like

| search hostname="<YourAppServers>" 
| eval TimeDiffInMin=round((now()-lastPhoneHomeTime)/60,2) 
| sort hostname 
| table hostname, TimeDiffInMin
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

twinspop
Influencer

Run over 24 hours. It will show any Fwds that haven't phoned home to the DS in the last hour. Change as required.

index=_internal sourcetype=splunkd_access host="yourDS" POST /services/broker/phonehome/connection | 
rex field=uri "_(?<fwd_name>[^_]+)_(?<fwd_id>[-0-9A-Z]+)$" | 
stats latest(eval(now()-_time)) as Latest earliest(eval(now()-_time)) as Earliest by fwd_name fwd_id clientip |
rename clientip as fwd_ip |
where Latest>3600

Change the where clause to where Earliest<(12*3600) to show anything logging newly in the last 12 hours, for example.

Warning: If your hosts have underscores in their names, the rex will not return the correct hostname, but the client ID and the IP will both still function.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...