Getting Data In

Testing Splunk UF config on Windows, with Inspec.

northernstar002
New Member

Hi,

I have 2 installations of Splunk. One on a Linux image, one on a Windows 2016 image - both on AWS.

I am testing that that both Trend and Splunk are configured correctly. I have a complete set of tests for the Linux version, but I'm having trouble refactoring for Windows Powershell (I am running my tests remotely and RDP-ing to the Windows VM.

My Linux code is as follows:


Splunk_Server = attribute('Splunk_Server')
Splunk_User = attribute('Splunk_User')
Splunk_Password = attribute('Splunk_Password')

describe command("sudo /opt/splunkforwarder/bin/splunk list forward-server -auth #{Splunk_User}:#{Splunk_Password}") do
its ('stdout') {should match /^Active.forwards:\n\t#{Splunk_Server}\nConfigured.but.inactive.forwards:\n\tNone/}

end


So, I want to read the output of the Linux command and have Inspec verify the output. The command will obviously change for Powershell. Any ideas what this would be to obtain the same result?

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...