Splunk Search

Why am I unable to get Splunk Search query in Ansible Playbook (everything works with curl)?

kumarvarun1252
New Member

Currently we manually monitor splunk dashboards during our deploys. We would like to automate this. For this, we would like to come up with an ansible playbook with the splunk queries. This playbook will be run during deployment.

I am successfully able to make connection to splunk, but I am not able to get the search query working

 

####
# type: task
#
# vars:
# 5xxcheck_output(str,command): raw output from command
# 5xxcheck_response(str,command): raw output to json
#
# desc:
# uses splunk to get 5xxcheck

---
- name: Tasks to query splunk
hosts: localhost
connection: local
tasks:
- name: get search_id for 5xx check from splunk
uri:
url: https://<splunk_instance>/services/search/jobs
follow_redirects: all
method: POST
user: xxxxxx
password: xxxxxxx
force_basic_auth: yes
body: "search host=tc1* ResponseCode=500 earliest=-15m"
body_format: raw
validate_certs: no
status_code: 201
return_content: true
register: search_id
- debug: msg="{{ search_id.status }}"

- name: use the search_id to get the 5xx check results
uri:
url: https://<splunk_instance>/services/search/jobs/{{ search_id }}/results/
method: GET
user: xxxxxx
password: xxxxxxx
force_basic_auth: yes
body_format: raw
return_content: true
register: 5xxcheck_output
until: 5xxcheck_output.status > 0 and 5xxcheck_output.status != 500

- name: Put results into 5xxcheck_response
set_fact:
5xxcheck_response: "{{ 5xxcheck_output.json }}"

- name: Print 5xxcheck_response if -v
debug:
var: 5xxcheck_response
verbosity: 1

 

I would like to use uri module to parameterize the splunk search. I am able to execute the following 2 steps from terminal, to get the response

Step1: Get the SID(Search ID)

 

curl -u user:pwd -k https://<splunk-instance>/services/search/jobs -d search="search host=t1* ResponseCode=200 earliest=-15m"

<?xml version="1.0" encoding="UTF-8"?>
<response>
<sid>1604947864.xxxxxx</sid>
</response>

 


Step2: Use the SID to get the response

 

curl -u user:pwd -k https://<splunk-instance>/services/search/jobs/<SID>/results/ --get -d output_mode=raw

 

Labels (2)
0 Karma

koshyk
Super Champion

I understand this is quite old, but please have a try like below..

- name: "SEARCH: Run Search and register Sid"
  uri:
    url: "{{splunk_ssl_uri}}:{{splunk.port.mgmt}}/services/search/jobs"
    method: POST
    user: xxxx
    password: xxxx
    body: 
      - [ search, "{{splunk_search}}"]
    status_code: [200, 201]
    force_basic_auth: yes
    validate_certs: no
    body_format: form-urlencoded
    return_content: true
  vars:
    - splunk_search: "search index=_internal | stats count"
  register: splunk_search_register
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...