Search query to fetch the list of servers

[sarahnazzar]

Hi Splunkers!

I'm trying to frame a query which fetches the list of servers that connects my deployment servers but do not send any external or internal logs to the same.

my query for the host last accessed time using metadata is working fine.. but above criteria is not working as expected.. its fetching all the servers connecting to my deployment server.

Thanks in Advance!

[jkat54]

 index=_internal sourcetype=splunkd phone home NOT [ | tstats count where index=* OR index=_* | fields host | return host]

Above might work to show you hosts that have phone home without showing those that have sent in data.

[shivanshu1593]

I'm assuming you're talking about the forwarders, connecting to your deployment master. Technically speaking, if a forwarder connects to a deployment master, then it means it is sending some sort of Internal data or phoning home. If you want to check which forwarders are reporting and which aren't, then the simplest way is to go to Settings -> Monitoring Console -> Forwarders -> Forwarders - deployment and scroll down to see the status of all of your forwarders, who are and have reported to your deployment master in the past. Those with the status of active are sending at least their Internal logs and those who are missing are not sending anything. If you want the report out of it, in the bottom of the panel, you'll find the Open in search option. You can click that.

If your looking at your Indexers, then opening Indexers' CM will give you an insight. If you're looking for something else, then please describe your problem in detail.

Hope this helps.

[jkat54]

Slight correction: It's called a deployment server not a deployment master.

[shivanshu1593]

Agreed. Thank you for the correction @jkat54 . I answer via my phone, and auto correct must have changed it.

[sarahnazzar]

This option is not enabled. Could you please help on the search query when we click on open in search..

Thanks! @shivanshu1593

[jkat54]

share your work...

what search have you tried for the metadata?

what are you missing from the search that is working?

whats an example of the final results you desire?

[sarahnazzar]

I tried checking the last accessed time.. @jkat54

| metadata type=hosts |where recentTime < now() - 86400 | eval lastaccessedtime= strftime(recentTime, "%F %T") |table host lastaccessedtime