Run Python scripts with universal forwarder to modify files on the server

[antoniocarletto]

Hello,

i would need to run a python script, using splunk's universal forwarder, on the servers where the forwarder is installed.

The goal of the script is to check the hostname in the input.conf file (in $ SPLUNK_HOME / etc / system / local) so that if the server hostname and the hostname in the input.conf file are different, the script change hostname in input.conf file and restart splunk.
If the hostnames are the same, it does nothing and exits the script.

The script must be run every night at 2:00 AM, and I would like once the app is created it will be distributed to all servers.

import sys
import fileinput
import subprocess
import re

print("[+] Splunk Hostname Changer")


def get_hostname_to_command():
    hostC = subprocess.getoutput('hostname')
    print("[+] Result to hostname command: " + hostC)
    return hostC


def get_hostname_to_file(path):
    file = open(path,"r")
    hostRow = file.readlines()[1]
    hostF = re.search(r'[^host\s\=\s][A-Za-z]*[\-]*[A-Za-z]+',hostRow).group(0)
    print("[+] Hostname in inputfile.conf: " + hostF)
    return hostF


def hostname_check(hostC,hostF,path):
    if hostC != hostF:
        print("[-] Hostname mismatch. Change the hostname in input.conf!")
        for line in fileinput.input(path,inplace=True):
            line = line.replace(hostF, hostC)
            sys.stdout.write(line)
        print("[+] Hostname changed. Operation Complete!")
        print("[+] Restart Splunk...")
        subprocess.call(["C:\Program Files\SplunkUniversalForwarder\\bin\splunk.exe","restart"])
        print("[+] Restart Splunk completed!")
    else:
        print("[+] Hostname match. Exit to script!")


hostCommand = get_hostname_to_command()
hostFile = get_hostname_to_file("C:\Program Files\SplunkUniversalForwarder\etc\system\local\input.conf")
hostname_check(hostCommand,hostFile, "C:\Program Files\SplunkUniversalForwarder\etc\system\local\input.conf")

I have read some information scattered around the web and I still don't understand if this type of business is available or not.
Is it possible to do this?

I'm here for further informations.

Best regards,

Antonio

[feelcool]

I found the solution

Python 3 modular input on a universal forwarder ve... - Splunk Community

[richgalloway · Accepted solution]

Universal Forwarders do not come with Python so they cannot run Python scripts.  You'll need a heavy forwarder for that.  If you can't run heavy forwarders then you'll need to write a shell script that does the work.

[marksheinbaum]

Is there a way to simulate that, i.e., hack. Say set up symlinks to python in Splunk's bin and lib directories?