Splunk Enterprise

Run Python scripts with universal forwarder to modify files on the server

antoniocarletto
Engager

Hello,

i would need to run a python script, using splunk's universal forwarder, on the servers where the forwarder is installed.

The goal of the script is to check the hostname in the input.conf file (in $ SPLUNK_HOME / etc / system / local) so that if the server hostname and the hostname in the input.conf file are different, the script change hostname in input.conf file and restart splunk.
If the hostnames are the same, it does nothing and exits the script.

The script must be run every night at 2:00 AM, and I would like once the app is created it will be distributed to all servers.

 

 

import sys
import fileinput
import subprocess
import re

print("[+] Splunk Hostname Changer")


def get_hostname_to_command():
    hostC = subprocess.getoutput('hostname')
    print("[+] Result to hostname command: " + hostC)
    return hostC


def get_hostname_to_file(path):
    file = open(path,"r")
    hostRow = file.readlines()[1]
    hostF = re.search(r'[^host\s\=\s][A-Za-z]*[\-]*[A-Za-z]+',hostRow).group(0)
    print("[+] Hostname in inputfile.conf: " + hostF)
    return hostF


def hostname_check(hostC,hostF,path):
    if hostC != hostF:
        print("[-] Hostname mismatch. Change the hostname in input.conf!")
        for line in fileinput.input(path,inplace=True):
            line = line.replace(hostF, hostC)
            sys.stdout.write(line)
        print("[+] Hostname changed. Operation Complete!")
        print("[+] Restart Splunk...")
        subprocess.call(["C:\Program Files\SplunkUniversalForwarder\\bin\splunk.exe","restart"])
        print("[+] Restart Splunk completed!")
    else:
        print("[+] Hostname match. Exit to script!")


hostCommand = get_hostname_to_command()
hostFile = get_hostname_to_file("C:\Program Files\SplunkUniversalForwarder\etc\system\local\input.conf")
hostname_check(hostCommand,hostFile, "C:\Program Files\SplunkUniversalForwarder\etc\system\local\input.conf")

 

 

I have read some information scattered around the web and I still don't understand if this type of business is available or not.
Is it possible to do this?

I'm here for further informations.

Best regards,

Antonio

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Universal Forwarders do not come with Python so they cannot run Python scripts.  You'll need a heavy forwarder for that.  If you can't run heavy forwarders then you'll need to write a shell script that does the work.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

feelcool
Explorer
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Universal Forwarders do not come with Python so they cannot run Python scripts.  You'll need a heavy forwarder for that.  If you can't run heavy forwarders then you'll need to write a shell script that does the work.

---
If this reply helps you, Karma would be appreciated.
0 Karma

marksheinbaum
Explorer

Is there a way to simulate that, i.e., hack. Say set up symlinks to python in Splunk's bin and lib directories?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...