In the Splunk Web Interface, you can navigate to /manager/system/deploymentserver to get access to a set of tables that give you information on your deployment infrastructure. Namely, the Apps, Server Classes, and Clients.
Clicking on one of this tabs gives you a table that can be filtered on in a few ways. Is it possible to expose these tables in a Splunk search? I have done some investigation of the REST documentation, and nothing has stood out.
This can be done through the REST interface, and the rest command in Splunk from the deployment server as such:
| rest splunk_server=local /services/deployment/server/clients
Although if you have many deployment clients (thousands), it can take just as long to run search as using the "forwarder management" interface.
This can be done through the REST interface, and the rest command in Splunk from the deployment server as such:
| rest splunk_server=local /services/deployment/server/clients
Although if you have many deployment clients (thousands), it can take just as long to run search as using the "forwarder management" interface.