Splunk Search

Splunk rest api , if hostname matched

burakatabay
Path Finder

Hi,
I try to if saved search result hostname is matched, reload deploy-server with rest API. But When saved search runs, the deploy server is reloading every time. My saved search cron schedule 5 minutes periods work.
There is a deploy server reload every 5 minutes.
How I do, if hostname is matched , reload deploy server.

 

My savedsearches.conf

[Syslog New Source Monitor]
action.syslogmonitor = 1
alert.digest_mode = 0
alert.suppress = 0
alert.track = 0
counttype = number of events
cron_schedule = */5 * * * *
dispatch.earliest_time = -5m
dispatch.latest_time = now
display.general.type = statistics
display.page.search.tab = statistics
enableSched = 1
quantity = 0
relation = greater than
request.ui_dispatch_app = search
request.ui_dispatch_view = search
search = index=inotify \
| rex field=_raw "ISDIR\s(?<path>.+)" \
| eval orig_path="/var/log/splunk/syslog/" \
| eval new_path=orig_path . path \
| stats count by host new_path \
| eval API = case(host=="splunk-sch", \
[| rest /services/deployment/server/serverclasses//HF%201/reload],host=="splunkfwd", \
[| rest /services/deployment/server/serverclasses//HF%202/reload], 1=1, 0)

 

image.png

 

 

 

 

 

No result doesnt come back but case statement is running.

image.png

 

 

Labels (2)

richgalloway
SplunkTrust
SplunkTrust

The problem lies in the final eval.

| eval API = case(host=="splunk-sch", \
[| rest /services/deployment/server/serverclasses//HF%201/reload],host=="splunkfwd", \
[| rest /services/deployment/server/serverclasses//HF%202/reload], 1=1, 0)

The square brackets around each rest command denote a subsearch and subsearches (almost) always execute first.  Therefore, the reload command is running before any conditions are tested.

SPL doesn't have conditional execution like programming languages do.  You may be able to work around that this way, however.

| eval API = case(host=="splunk-sch", 
"\| rest /services/deployment/server/serverclasses//HF%201/reload",host=="splunkfwd", 
"\| rest /services/deployment/server/serverclasses//HF%202/reload", 1=1, "noop")
| map search="$API$"

 I have to ask, however, what you are trying to accomplish.  Reload the deployment server is not a routine task.  It's something that is necessary only when the serverclass.conf file is modified.  What is the problem you are trying to solve with this search?

---
If this reply helps you, Karma would be appreciated.

burakatabay
Path Finder

Hi @richgalloway 

Thank you for answers.

Firstly;

if any result doesn't come back, splunk search is fail.image.png

 

Secondly;

if any result come back, rest doesn't running.image.png

The reason why I want to do this is that, I want this custom alert action python script to trigger when there is a new Syslog added to SplunkHF, the script would add the newly discovered Syslog paths onto the deployment_apps inputs.conf to monitor those new paths and then send the deployed app towards the splunkHF. I have added the correct information to inputs.conf, Incase any results are returned I just want to Reload the related server class.

 

Happy Splunking.

Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...