Splunk Search

REST search for Deployment Client Forwarder Management Console

muebel
SplunkTrust
SplunkTrust

In the Splunk Web Interface, you can navigate to /manager/system/deploymentserver to get access to a set of tables that give you information on your deployment infrastructure. Namely, the Apps, Server Classes, and Clients.

Clicking on one of this tabs gives you a table that can be filtered on in a few ways. Is it possible to expose these tables in a Splunk search? I have done some investigation of the REST documentation, and nothing has stood out.

0 Karma
1 Solution

muebel
SplunkTrust
SplunkTrust

This can be done through the REST interface, and the rest command in Splunk from the deployment server as such:

| rest splunk_server=local /services/deployment/server/clients

Although if you have many deployment clients (thousands), it can take just as long to run search as using the "forwarder management" interface.

View solution in original post

muebel
SplunkTrust
SplunkTrust

This can be done through the REST interface, and the rest command in Splunk from the deployment server as such:

| rest splunk_server=local /services/deployment/server/clients

Although if you have many deployment clients (thousands), it can take just as long to run search as using the "forwarder management" interface.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...