Splunk search for Deployment Clients Phoning Home to Deployment Server
Copy
index=_internal sourcetype=splunkd *phonehome* component=DC* | stats latest(_time) as _time, latest(_raw) as _raw by host
This search will return the most recent event for each deployment client that is attempting to phone home to a deployment server. This search will return both successful and unsuccessful attempts to phone home.