Deployment Architecture

Is it possible to tell if users are online before reboot?

nick405060
Motivator

Is it possible to query for online users via CLI, not through SPL? I reboot frequently and want my reboot shell script to say "WARNING: (1) users are online. Are you sure you want to reboot?"

Currently I go run a SPL search every time I reboot to make sure nobody is online, which is a huge pain

Or am limited to doing this with Python SDK?

0 Karma
1 Solution

martynoconnor
Communicator

martynoconnor
Communicator

You can search from the CLI, but you'll still have to use SPL:

https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchReference/CLIsearchsyntax

nick405060
Motivator

Thanks. I should have clarified, I am fine doing it through SPL, I just didn't want to do it through the search UI.

I didn't use the Python SDK to do write this, just did it in normal Python (my bash scripting isn't quite up to par to do this in bash):

import os

query = os.popen('/opt/splunk/bin/splunk search "search earliest=-3m latest=now \`users_online\`"').read()

if "--------" in query:
        print "CAUTION: Users are online. Perform manual reboot."
else:
        print "Users are not online. Rebooting"
        os.system("/opt/splunk/bin/splunk stop -f && /opt/splunk/bin/splunk start")
0 Karma

nick405060
Motivator

Macro:

(index=_internal sourcetype=splunkd_ui_access uri_path="/en-US/app*") OR (index=_audit AND action="login attempt" OR (search!="" search_id!="'scheduler*"  search_id!="scheduler*" search_id!="'subsearch*")) user!="splunk-system-user" user!="n/a" user!="ME" user!=testuser* user!="-" | eval sortable_time=_time | eval time=strftime(sortable_time,"%Y-%m-%d %H:%M:%S") |
streamstats count as temp_count | stats values(*) as * by temp_count | fields - temp_count | sort 0 sortable_time | dedup user | table user
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>