Splunk Enterprise

Python script to clock error on splunkd.log only success message to index

DataOrg
Builder

All, 

I need help in indexing only success response in Splunk and the failure response like error/authentication failed/host down are in splunkd.log

Please help me in python script to index the failed message in log file.

Below is the script:

 

import requests
import json
import urllib
import sys 
import os

host=(str(sys.argv[1]))

headers={
        "accept": "application/json",
        "content-type": "application/json"
}
	
Input_URL= ['https://{host}.com/apigee/files/data'.format(host=host)]

def return_json(url):
    try:
        response = requests.get(url,headers=headers)		

           if not response.status_code // 100 == 2:
            return "ERROR: Unexpected response {}".format(response)
		
        json_obj = response.json()
        return json.dumps(json_obj)
    except requests.exceptions.RequestException as e:
                return "ERROR: {}".format(e)
for url in Input_URL:
    print return_json(url)

 

Labels (2)
Tags (3)
0 Karma

livehybrid
Builder

Are you already running that script outside the Splunk environment? If so you might want to take a look at sending the result via HEC (https://www.splunk.com/en_us/blog/customers/http-event-collect-a-python-class.html)

If not, you could use that code a base for an input by creating an Add-on with the Splunk Add-On Builder (https://splunkbase.splunk.com/app/2962/)

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...