Splunk Search

REST search for Deployment Client Forwarder Management Console

muebel
SplunkTrust
SplunkTrust

In the Splunk Web Interface, you can navigate to /manager/system/deploymentserver to get access to a set of tables that give you information on your deployment infrastructure. Namely, the Apps, Server Classes, and Clients.

Clicking on one of this tabs gives you a table that can be filtered on in a few ways. Is it possible to expose these tables in a Splunk search? I have done some investigation of the REST documentation, and nothing has stood out.

0 Karma
1 Solution

muebel
SplunkTrust
SplunkTrust

This can be done through the REST interface, and the rest command in Splunk from the deployment server as such:

| rest splunk_server=local /services/deployment/server/clients

Although if you have many deployment clients (thousands), it can take just as long to run search as using the "forwarder management" interface.

View solution in original post

muebel
SplunkTrust
SplunkTrust

This can be done through the REST interface, and the rest command in Splunk from the deployment server as such:

| rest splunk_server=local /services/deployment/server/clients

Although if you have many deployment clients (thousands), it can take just as long to run search as using the "forwarder management" interface.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!