Splunk Deployment Server: Grab all deployment clients

There are times when you need to know what’s out there. If you’re like me, you have thousands of deployment clients in the environment, and browsing to the GUI interface to see your forwarders just doesn’t cut it.

The following can be run as a search on your deployment server to pull all of your deployment clients.

    | rest /services/deployment/server/clients splunk_server=local | table hostname dns clientName utsname

You can then pipe this out to outputcsv to better use the data.

If for some reason you cannot do it this way, you can always pull information on the command line. To get all the IP addresses of your clients, run the following:

    /opt/splunk/bin/splunk list deploy-clients | grep -Po 'ip:\s+\K([0-9]{1,3}\.){3}[0-9]{1,3}'
 
13
Kudos
 
13
Kudos

Now read this

Splunk - Diff examples and One-Way diff

Splunk’s ‘set’ command will allow you to ‘diff’ two result sets. What this means is that say you have two sets: Set A: “event1 event2 event3” Set B: “event2 event3 event4” Splunk will tell you all the differences that occur between these... Continue →