Hi,
I know there are other ways to get this through the deployment server, but I'm trying to find a SPL to get results of which of my Splunk UF clients currently has a specific deployment app.
I have been able to use this SPL to find all all deployment apps on all my Splunk UF clients:
| rest /services/deployment/server/clients splunk_server=splunkdeploy01*
| table hostname applications*.stateOnClient
| untable hostname applications value
| eval applications=replace(applications,"applications\.(\w+)\.stateOnClient","\1")
| stats values(applications) as applications by hostname
However, I'm looking for a SPL that searches across all Splunk UF clients for a specific deployment app: "all_splunk_uf"
Thanks!
| rest /services/deployment/server/clients splunk_server=splunkdeploy01*
| table hostname applications*.stateOnClient
| untable hostname applications value
| eval applications=replace(applications,"applications\.(\w+)\.stateOnClient","\1")
| search applications="all_splunk_uf"
| stats values(applications) as applications by hostname
Filter on the application name.
| rest /services/deployment/server/clients splunk_server=splunkdeploy01*
| table hostname applications*.stateOnClient
| untable hostname applications value
| eval applications=replace(applications,"applications\.(\w+)\.stateOnClient","\1")
| search applications="all_splunk_uf"
| stats values(applications) as applications by hostname
Filter on the application name.