I want to distinguish between servers which are down and servers which have stopped splunkd service. After that I need to create a button in Dashboard which will trigger a script which will go to the respective server and take the necessary action.

[sandyIscream]

I want to distinguish between servers which are down and servers which have stopped splunkd service. After that I need to create a button in Dashboard which will trigger a script which will go to the respective server and take the necessary action.

Currently our client wants a dashboard where we can see the down agents and a button after that to trigger a script that will up the Splunk agent.

Please tell whether it's possible or not ?

Thanks in Advance.

[acharlieh]

In theory, it's possible... You'll likely want to pull data and APIs from your Endpoint Monitoring/Management solution (something like Tanium), and you probably also want to bring in data from your change management/ticketing system, inventory & asset management, and configuration management systems as well.

But as you develop such make sure you are considering the security implications of having that button as well, guard against the possibility of someone being able to pervert the ability to start a service to become an arbitrary privileged command and control mechanism across your client's enterprise.