How do I edit 'allSites' variable in the nexpose_reports.py to select specific sites for data retrieval.

[windbishn]

By default, data on all sites will be collected. If only data on specific sites is required please edit the 'allSites' variable within the 'nexpose_reports.py' file following the instructions included within the collector script.

nexpose_reports.py
Sites to report on. For specific sites only, set the 'sites' variable to an array e.g. [1, 3, 12] where the numbers are the site IDs on which data will be collected.

allSites = nexposeClient.site_id_listing()
logger.info("Gathering data on sites <" + ', '.join(nexposeClient.site_name_listing()) + "> with IDs <" + (str(allSites).strip('[]') ) + ">")
sites_to_query = allSites

[JJCassidy_R7 · Accepted solution]

You modify the nexpose_reports.py file and change the allSites variable from:

allSites = nexposeClient.site_id_listing()

To:

allSites = [1,17,123,99]

The IDs are those of the corresponding sites within Nexpose and can be found in the site URL e.g. https://<$NEXPOSE_CONSOLE>/site.jsp?siteid=17. You just take however many site IDs you want data to be collected on and add them to the script. The next time the application collects data it will be limited to those specific sites.

Another way of doing this is modifying the configured Nexpose user that the application uses to login to the Nexpose console and limit the user's access to only the sites you want data retrieved for. This will require no change to the Splunk application and will achieve the same goal.

[windbishn]

Wow, it makes sense looking at it now but I was trying to work within the entire variable. I appreciate the assist.