Skip to content

Instantly share code, notes, and snippets.

@yorokobi

yorokobi/gist:7c63e36c6c445f6f62f1

Last active January 27, 2020 21:04
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save yorokobi/7c63e36c6c445f6f62f1 to your computer and use it in GitHub Desktop.
Save yorokobi/7c63e36c6c445f6f62f1 to your computer and use it in GitHub Desktop.
Download ZIP
Client info from Deployment Server
Raw
gistfile1.txt
| rest /services/deployment/server/clients splunk_server=local
| fields averagePhoneHomeInterval build clientName guid hostname lastPhoneHomeTime splunkVersion utsname
| rex field=hostname "(?<sourceHost>[^\.]+)\.(?<sourceDomain>.+)"
| eval sourceHost = if( isnull(sourceDomain), hostname, sourceHost )
| eval sourceHost = lower(sourceHost)
| rex field=utsname "(?<os>[^\-]+)\-(?<arch>.+)"
| eval os = case( os = "linux", "Linux", os = "windows", "Windows" )
| fields - utsname hostname
| convert timeformat="%F %T" ctime(lastPhoneHomeTime)
| table sourceHost sourceDomain os arch splunkVersion build guid clientName averagePhoneHomeInterval lastPhoneHomeTime updated
| sort splunkVersion sourceHost sourceDomain
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment