All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

I don't have admin rights in Splunk. Is there an easy way to enforces this in the search query? 
Hi @FAnalyst  The answers provided so far look to either look at forwarders sending data to your Splunk indexers, or look at allowlist configurations in serverclasses, however I believe you are look... See more...
Hi @FAnalyst  The answers provided so far look to either look at forwarders sending data to your Splunk indexers, or look at allowlist configurations in serverclasses, however I believe you are looking for the host and IP of deployment clients when they connect? If that is the case then try the below search:   | tstats latest(_time) as lastPhoneHome WHERE index=_dsphonehome earliest=-24h latest=now by data.clientId | append [| tstats latest(_time) as lastRestart where index=_dsclient earliest=0 latest=now by data.name, data.build, data.clientId, data.splunkVersion data.package, data.hostname] | stats latest(*) AS * by data.clientId | eval lastPhoneHomeFriendly=strftime(lastPhoneHome,"%d/%m/%Y %H:%M:%S")   This was tested on SPlunk 9.3 but I believe should work from <9.2 Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped. Regards Will
Hi @shabamichae , yes, you can do it. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors
Hello I got the same question that was also asked in 2017.(The solution is outdated and doesn't work anymore) "With a SAAS controler, how can i get a clear report of how many licences are consumed... See more...
Hello I got the same question that was also asked in 2017.(The solution is outdated and doesn't work anymore) "With a SAAS controler, how can i get a clear report of how many licences are consumed by application ? I dont need the speed dials that tell me how many licenses are consumed total. What i need is the license count per actual application that i have created in appDynamics. We need this to figure out what is the cost per application." have it been implemented or its there a way in 2024 to get this?
@FAnalyst  Try this  index=_internal sourcetype=splunkd component=Metrics group=tcpin_connections | dedup sourceHost | table sourceHost fwdType
@FAnalyst  You should be able to get list of whitelist servers using following query. | rest /services/deployment/server/serverclasses | table title whitelist.* | untable title whitelist hostname |... See more...
@FAnalyst  You should be able to get list of whitelist servers using following query. | rest /services/deployment/server/serverclasses | table title whitelist.* | untable title whitelist hostname | stats count by hostname | table hostname You can put it to in a lookup file or just use the rest query itself and compare it against deployment/server/clients to know which clients that are configured in serverclass.conf but not sending phonehome. Something like this | rest /services/deployment/server/serverclasses | table title whitelist.* | untable title whitelist hostname | stats count by hostname | table hostname | eval state="configured" | append [| rest /services/deployment/server/clients | table title | rename title as hostname | eval state="phonehome" ] | stats values(state) as state by hostname | where mvcount(state)=1 AND state="configured"  
Thanks
@FAnalyst  Use the below search to get an exportable list of deployment clients. | rest splunk_server=local /services/deployment/server/clients | table hostname utsname | sort utsname Another ... See more...
@FAnalyst  Use the below search to get an exportable list of deployment clients. | rest splunk_server=local /services/deployment/server/clients | table hostname utsname | sort utsname Another way to find forwarders is to search the internal index for incoming TCP connections. index=_internal sourcetype=splunkd component=Metrics group=tcpin_connections | dedup sourceHost | table sourceHost fwdType   To see all hosts that send data, not just forwarders, count the hosts found in all indexes. | tstats count where index=* host=* by host  
thank you for your answer ,I tried the search you shared is does not show the IP  address of the hosts , also the number does not match the number showing in the forwarder management dashboard 
You can serch using following searches: | tstats values(splunk_server) as Host, values(clientip) as IP from _internal where index=_internal sourcetype=splunkd by host or  index=_internal sou... See more...
You can serch using following searches: | tstats values(splunk_server) as Host, values(clientip) as IP from _internal where index=_internal sourcetype=splunkd by host or  index=_internal sourcetype=splunkd | stats values(clientip) as IP by host Enjoy,  
@att35If you find the provided solution satisfactory, please proceed with accepting it.
I see there is a forwarder management dashboard in the monitoring console  where you can check if the host is reporting or not , I want the search that is used as the table contains the host name and... See more...
I see there is a forwarder management dashboard in the monitoring console  where you can check if the host is reporting or not , I want the search that is used as the table contains the host name and the IP address , also there is no option for export in that dashboard , there is another similar dashboard in the monitoring console named forwarder_deployment but does not show the IP address only the host name , can you help with that ?
@shabamichae  Yes, you can run the Deployment Server, License Master, and Monitoring Console on the same Splunk instance using the same port (default port 8089 for management). However, there are a ... See more...
@shabamichae  Yes, you can run the Deployment Server, License Master, and Monitoring Console on the same Splunk instance using the same port (default port 8089 for management). However, there are a few things to consider: Resource Efficiency: Good for lab environments or small deployments where resources are limited. Simpler Management: easier to manage since all roles are on a single instance.
@gcusello  So, if I get you correctly, In the practical Lab exam, I can run Deployment Server, License Master and the Monitoring Console on the same instance with same port
Thanks @kiran_panchavat  So, if I get you correctly, In the practical Lab exam, I can run Deployment Server, License Master and the Monitoring Console on the same instance with same port
o, sorry for the late reply. If I run that one -current_member_uri     I get below issue Node splsearch01 is already part of cluster id=2A5DDFE0-B873-4201-8B68-D2ACB4873DA7. To add a new member... See more...
o, sorry for the late reply. If I run that one -current_member_uri     I get below issue Node splsearch01 is already part of cluster id=2A5DDFE0-B873-4201-8B68-D2ACB4873DA7. To add a new member via this node use new_member_uri. Run 'splunk help add shcluster-member' for more info.
Hi @JJMonster , let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all t... See more...
Hi @JJMonster , let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors
Hi @att35  No - Apps you create directly on the SHC will not be affected by deployment pushes from a SH deployer.  The effect of changing deployer_push_mode only applies to apps pushed by the deplo... See more...
Hi @att35  No - Apps you create directly on the SHC will not be affected by deployment pushes from a SH deployer.  The effect of changing deployer_push_mode only applies to apps pushed by the deployer, not apps created locally on the SHC. Although this doesnt mean that you should manage apps independently of the deployer   Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped. Regards Will
There is a number of things to consider here, such as maintaining a data dictionary of where certain types of data are stored, etc.  However - One of the first things I always try and do to optimise... See more...
There is a number of things to consider here, such as maintaining a data dictionary of where certain types of data are stored, etc.  However - One of the first things I always try and do to optimise a search is use TERM("value") in the SPL. See screenshots below of simple example across 30 days for an IP on a local instance. This returned the data in half the time when using TERM("some.ip.address") Before After: Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped. Regards Will    
Hi @JJMonster , if clicking on the Download button you're redirected to a website, it isn't possible a direct download! Ciao. Giuseppe