Deployment Architecture

I want to map serverclasses to their apps and client whitelists, but noticed something odd.... serverclasses and applications endpoints can't really be joined.

lycollicott
Motivator

Well I thought it was odd, anyway.

I have a serverclass called "Lar Test" and it has three apps assigned to it. I just want to join a REST call to serverclasses to a REST call to applications. Sounded like a pretty simple thing to do before the long weekend, right? Just join those puppies up, right?

Now why does Splunk use three different serverclass names on the applications endpoint?

alt text

1 Solution

lycollicott
Motivator

Ok, I scrolled down my endless to-do and follow-up list this morning and came upon this forgotten little gem of a question, so I said, "Hey, it's Friday before a long weekend. Let's waste a little time on this and drink some coffee."

It was shortly after that when I realized what an incredibly stupid question this really was. I could have deleted it and tried to erase my shame from the endless internet where all things are true, but I have instead chosen to publicly confess my idiocy.

Are you ready? serverclasses is a multi-value field.

| rest /services/deployment/server/serverclasses splunk_server=deploy01 
| rename title as SC 
| search SC=lar* 
| join SC 
    [| rest /services/deployment/server/applications splunk_server=deploy01
    | rename serverclasses as SC, title as App 
    | mvexpand SC
    | search SC=lar* ]
| table SC, App, whitelist.*, blacklist.*

alt text
alt text

View solution in original post

lycollicott
Motivator

Ok, I scrolled down my endless to-do and follow-up list this morning and came upon this forgotten little gem of a question, so I said, "Hey, it's Friday before a long weekend. Let's waste a little time on this and drink some coffee."

It was shortly after that when I realized what an incredibly stupid question this really was. I could have deleted it and tried to erase my shame from the endless internet where all things are true, but I have instead chosen to publicly confess my idiocy.

Are you ready? serverclasses is a multi-value field.

| rest /services/deployment/server/serverclasses splunk_server=deploy01 
| rename title as SC 
| search SC=lar* 
| join SC 
    [| rest /services/deployment/server/applications splunk_server=deploy01
    | rename serverclasses as SC, title as App 
    | mvexpand SC
    | search SC=lar* ]
| table SC, App, whitelist.*, blacklist.*

alt text
alt text

woodcock
Esteemed Legend

You can add the bugs tag to your question.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...