Run Python scripts with universal forwarder to modify files on the server

antoniocarletto — Mon, 12 Oct 2020 14:34:06 GMT

Hello,

i would need to run a python script, using splunk's universal forwarder, on the servers where the forwarder is installed.

The goal of the script is to check the hostname in the input.conf file (in $ SPLUNK_HOME / etc / system / local) so that if the server hostname and the hostname in the input.conf file are different, the script change hostname in input.conf file and restart splunk.
If the hostnames are the same, it does nothing and exits the script.

The script must be run every night at 2:00 AM, and I would like once the app is created it will be distributed to all servers.

import sys import fileinput import subprocess import re print("[+] Splunk Hostname Changer") def get_hostname_to_command(): hostC = subprocess.getoutput('hostname') print("[+] Result to hostname command: " + hostC) return hostC def get_hostname_to_file(path): file = open(path,"r") hostRow = file.readlines()[1] hostF = re.search(r'[^host\s\=\s][A-Za-z]*[\-]*[A-Za-z]+',hostRow).group(0) print("[+] Hostname in inputfile.conf: " + hostF) return hostF def hostname_check(hostC,hostF,path): if hostC != hostF: print("[-] Hostname mismatch. Change the hostname in input.conf!") for line in fileinput.input(path,inplace=True): line = line.replace(hostF, hostC) sys.stdout.write(line) print("[+] Hostname changed. Operation Complete!") print("[+] Restart Splunk...") subprocess.call(["C:\Program Files\SplunkUniversalForwarder\\bin\splunk.exe","restart"]) print("[+] Restart Splunk completed!") else: print("[+] Hostname match. Exit to script!") hostCommand = get_hostname_to_command() hostFile = get_hostname_to_file("C:\Program Files\SplunkUniversalForwarder\etc\system\local\input.conf") hostname_check(hostCommand,hostFile, "C:\Program Files\SplunkUniversalForwarder\etc\system\local\input.conf")

I have read some information scattered around the web and I still don't understand if this type of business is available or not.
Is it possible to do this?

I'm here for further informations.

Best regards,

Antonio

Re: Run Python scripts with universal forwarder to modify files on the server

richgalloway — Mon, 12 Oct 2020 14:39:35 GMT

Universal Forwarders do not come with Python so they cannot run Python scripts. You'll need a heavy forwarder for that. If you can't run heavy forwarders then you'll need to write a shell script that does the work.

Re: Run Python scripts with universal forwarder to modify files on the server

feelcool — Sat, 04 Dec 2021 13:18:19 GMT

I found the solution

Python 3 modular input on a universal forwarder ve... - Splunk Community

Re: Run Python scripts with universal forwarder to modify files on the server

marksheinbaum — Thu, 18 Aug 2022 03:36:22 GMT

Is there a way to simulate that, i.e., hack. Say set up symlinks to python in Splunk's bin and lib directories?

topic Run Python scripts with universal forwarder to modify files on the server in Splunk Enterprise

Run Python scripts with universal forwarder to modify files on the server

Re: Run Python scripts with universal forwarder to modify files on the server

Re: Run Python scripts with universal forwarder to modify files on the server

Re: Run Python scripts with universal forwarder to modify files on the server