topic Re: Splunk integration with thousandeyes in Other Usage

Splunk integration with thousandeyes

stufty — Wed, 03 Jan 2018 16:34:19 GMT

Has anyone hooked up Splunk to the thousandeyes network monitor? I would rather not re-invent the wheel, but I would like to import what it sees into my Splunk repository.

Thanks in advance - Steve

Re: Splunk integration with thousandeyes

stufty — Fri, 25 May 2018 18:14:25 GMT

What we wound up doing is writing a C# windows service that hits the Thousand eyes API and reports any test failures. The frequency of this polling is configurable, but set to every 5 minutes by default. Not perfect, but we are getting valuable data.

Re: Splunk integration with thousandeyes

HackerAce1 — Thu, 23 May 2019 17:08:47 GMT

I would be interested to know how the integration works and if you would be willing to share?

Re: Splunk integration with thousandeyes

stufty — Thu, 23 May 2019 18:19:55 GMT

sure @HackerAce, here is the guts of our C# capture routine. We pass in https://api.thousandeyes.com/alerts.xml as the URI. Once you get the data, you can parse it and then either use HEC or write to a file that a UF is reading from.

Cheers - Steve

public static string Fetch(string URI)
{
    string content = string.Empty;
    string username = Credentials.GetUsername();
    string password = Credentials.GetPassword();
    string userpass = string.Format("{0}:{1}", username, password);
    WebRequest req = WebRequest.Create(URI);
    req.Method = "GET";
    req.Headers["Authorization"] = "Basic " + Convert.ToBase64String(Encoding.Default.GetBytes(userpass));
    HttpWebResponse resp = req.GetResponse() as HttpWebResponse;
    if (resp.StatusCode == HttpStatusCode.OK)
    {
        using (var stream = resp.GetResponseStream())
        using (var sr = new StreamReader(stream))
        {
            content = sr.ReadToEnd();
        }
    }
    return content;
}