We have a bunch of servers with UFs installed. These servers may have different operational states. For example, "Active", "Build in Progress", "Decommissioned", and "Decom in Progress". We use ServiceNow for the asset inventory.
This is the search query used to determine the version of the UFs installed.
index=_internal source=*metrics.log component=Metrics group=tcpin_connections | dedup hostname | table hostname sourceIp os arch version
I would like to be able to get the Active servers that have splunk UF installed and NOT reporting to splunk.
Also, looking for a way to dynamically update the list of Active servers, as this list changes whenever there are new servers onboarded or old servers decommissioned.
I've looked at the Splunk App/Add-on for ServiceNow and could not find an option to do this.
I've also looked at https://docs.splunk.com/Documentation/Splunk/7.3.1/DMC/Configureforwardermonitoring, but am not sure how to go about configuring it to dynamically update the asset list with the Active servers.
Any help will be much appreciated.
↧