Getting Data In

I want to distinguish between servers which are down and servers which have stopped splunkd service. After that I need to create a button in Dashboard which will trigger a script which will go to the respective server and take the necessary action.

sandyIscream
Communicator

I want to distinguish between servers which are down and servers which have stopped splunkd service. After that I need to create a button in Dashboard which will trigger a script which will go to the respective server and take the necessary action.

Currently our client wants a dashboard where we can see the down agents and a button after that to trigger a script that will up the Splunk agent.

Please tell whether it's possible or not ?

Thanks in Advance.

0 Karma

acharlieh
Influencer

In theory, it's possible... You'll likely want to pull data and APIs from your Endpoint Monitoring/Management solution (something like Tanium), and you probably also want to bring in data from your change management/ticketing system, inventory & asset management, and configuration management systems as well.

But as you develop such make sure you are considering the security implications of having that button as well, guard against the possibility of someone being able to pervert the ability to start a service to become an arbitrary privileged command and control mechanism across your client's enterprise.

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...