Skip to content

Instantly share code, notes, and snippets.

@faststeak
Created November 9, 2017 17:16
Show Gist options
  • Save faststeak/b75aca9770e7096a8e09eb47e12b984d to your computer and use it in GitHub Desktop.
Save faststeak/b75aca9770e7096a8e09eb47e12b984d to your computer and use it in GitHub Desktop.
Splunk Deployment Server - Search to find server class, app, and client info
| rest splunk_server=local /services/deployment/server/clients
| fields applications.*, title,clientName, dns, ip, instanceName
| foreach applications.*.archive
[ eval apps=mvappend(apps, '<<FIELD>>')]
| foreach applications.*.serverclasses
[ eval serverClass=mvappend(serverClass, '<<FIELD>>')]
| fields apps, serverClass, title, clientName, dns, ip, instanceName
| rex field=apps max_match=100 "(?<app_name>[^\/]+)-\d+\.bundle"
| fields - apps
| stats dc(app_name) values(*) AS * by title
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment