Splunk Search

View all Splunk instance in a single Splunk?

Vinesh93
Explorer

We have 6 splunk deployment server and need to login to every server to see the dashboards in respective servers. Is there any possible ways to manage a single splunk instance where i can see all dashboards from 6 servres?

Thanks in advance 🙂

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Vinesh93,
no There isn't a Federated Deployment Server, I asked it many times to Splunk but no answer!
You could see the situation of each deployment server, extracting data from each DS and sending this data to Indexers, so you can search and display these data on a Search Head.
I did this configuration using a scheduled report on each DS that wrote situation every hour on a CSV file, the file was sent to indexers and I did a dashboard.
Otherwise, you could use rest to remotely extract the samedata from each DS, but the other solution is easier.
The search I used was:

| rest splunk_server=local /services/deployment/server/clients\
| table hostname ip utsname *.restartSplunkd\
| eval temp=hostname."#".ip."#".utsname \
| table temp *.restartSplunkd\
| untable temp apps count \
| eval Apps=if(like(apps,"app%"),mvindex(split(apps,"."),1),null()) \
| eval ServerClass=if(like(apps,"server%"),mvindex(split(apps,"."),1),null() ) \
| rex field=temp "(?<Host>.*)#(?<Host_IP>.*)#(?<Machine_Type>.*)" \
| table Host Host_IP Machine_Type Apps ServerClass \
| stats Values(*) as * by Host Host_IP Machine_Type\
| nomv Apps\
| nomv ServerClass\
| outputcsv ServerClassesList.csv

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...