About dominiquevocat

dominiquevocat · ‎01-18-2017

Hi, first of all i didn't open the thread so i was not notified sorry. Um, i really need to compile a set of sourcetypes and so on... i have a couple of scripts to collect stats and dashboards and so on. Alternatively there is a swiss company (Skypro) that developed something based on open source software that does a lot of what you might want to do. Anyway, the trick i once tried with xdas was to change the patter for the syslog config to include a date and timestamp and then define a sourcetype that breaks on that pattern. The json format is quit verbose though. What we do is mostly log directory stuff we want to know in a driver so you just filter for the operations you want to know and log it. Currently we use idmlog4j but i would like to test the java class for logging but it needs to be only using static methods else it won't work. Alternatively i am looking into using the http event collector and the rest driver but yeah, it works now so why change much. We also collect some logfiles, ldap stats and dxcmd info using a forwarder but its not polished at all. I can give the code we use i guess...

dominiquevocat · ‎01-10-2017

Hm, i seem to bale to include a script in /bin of an app and define it as input and launch it remotely using curl -u admin:changeme https://localhost:8089/servicesNS/nobody /myApp/data/inputs/script/.%5Cbin%5Cmyscript.cmd -k So that is part of the way. I would like to pass some parameter. Also the interval poses a problem. I for now user interval = -1 but i am not sure of i can set an interval of 0 for "never"...

dominiquevocat · ‎01-09-2017

Is there a way to run a script residing in one of the /bin folders of an app on a universal forwarder via a rest call with some parameters? Security wise it would need to be only files in an app and not an arbitrary file on the target machine 🙂

dominiquevocat · ‎12-30-2016

maybe its a silly question but: is the prtg.conf in /local ?

dominiquevocat · ‎12-04-2016

Just return _time as epoch.

dominiquevocat · ‎12-02-2016

doh' if i just send it as epoch its fine. Erm.

dominiquevocat · ‎11-30-2016

I have data where i get a date/timestamp as a string and an offset as a string from some API. I manage to generate the _time field and it shows properly in the event view and stuff like time based drilldown (plus minus n seconds) works. However only the field _time is available on the event and the date_hour etc fields do not show up, thus timechart etc won't work. I tried to generate the timestamp subfields and append them to the event but they are not visible in Splunk. What do i need to take care of to get proper events with a proper timestamp?

dominiquevocat · ‎11-29-2016

Nice, however this will not work if you use the regular webport and then get the rest api via this port using /splunkd/__raw/services/auth/login as it cannot handle the callback parameter 😕 (I would like to use the regular port for a number of reasons, one being we do not open firewall access to the rest port and i also potentially would like to use sso).

dominiquevocat · ‎11-25-2016

I configured the HTTP Event Collector and tested it successfully with wget/curl HomeAssistant app for Splunk complains however and i do not get any events from HomeAssistant as per the below snippet from the log. 16-11-25 22:37:49 homeassistant.components.splunk: Error saving event to Splunk: ('Connection aborted.', BadStatusLine("''",)) Traceback (most recent call last): File "/usr/local/lib/python3.4/dist-packages/requests/packages/urllib3/connectionpool.py", line 594, in urlopen chunked=chunked) File "/usr/local/lib/python3.4/dist-packages/requests/packages/urllib3/connectionpool.py", line 391, in _make_request six.raise_from(e, None) File "<string>", line 2, in raise_from File "/usr/local/lib/python3.4/dist-packages/requests/packages/urllib3/connectionpool.py", line 387, in _make_request httplib_response = conn.getresponse() File "/usr/lib/python3.4/http/client.py", line 1172, in getresponse response.begin() File "/usr/lib/python3.4/http/client.py", line 351, in begin version, status, reason = self._read_status() File "/usr/lib/python3.4/http/client.py", line 321, in _read_status raise BadStatusLine(line) http.client.BadStatusLine: ''

dominiquevocat · ‎11-25-2016

glad you like it. open for suggestions @ncsantucci

dominiquevocat · ‎11-14-2016

Have a look at https://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Restmapconf

dominiquevocat · ‎11-04-2016

Is there any way to get a developer license of Splunk IT Service Intelligence (ITSI) and/or Splunk Enterprise Security (ES)? I would love to adapt my apps to fit into ITSI/ES and add adaptive response actions and so on but the place i work is not licensing it anytime soon 😕

dominiquevocat · ‎11-01-2016

I am wondering the same. Since the handling seems to be done by $SPLUNK_HOME/bin/rest_handler.py i think it will n ot work since there is no python on a universal forwarder. I have a script that i would like to expose as a custom rest endpoint but i get a 400/bad request as a reply.

dominiquevocat · ‎10-25-2016

I fail to see in the docs how you can delete/edit/set the deploy-poll setting via REST. Anyone knows how to?

dominiquevocat · ‎10-25-2016

We have the same issue and a support case open. No solution as of the last few err months...

dominiquevocat · ‎10-24-2016

offhand? nope. I basically do this: https://prtg.paessler.com/api/table.xml?username=demo&password=demodemo&content=sensors&columns=objid,type,group,device,sensor,status,message,lastvalue,priority,favorite you can run it against your webinterface of prtg. Note: this custom command is one i want to rewrite but so far i haven't gotten arround to it... how about you contact me directly? You can find me easily on google+ or facebook.

dominiquevocat · ‎10-13-2016

Because i missed out removing the references. Were you specifically missing them or why do you conclude it does not work?

dominiquevocat · ‎10-11-2016

import readconfig is too much, sorry to have it in the published code.

dominiquevocat · ‎10-10-2016

um, i found a few mistakes and put a version runnin on my home based mini windows environment up on https://github.com/dominiquevocat/TA-prtg

dominiquevocat · ‎10-10-2016

Back at the office. I had to include the splunklib in the bin folder 😞 Additionally there is a superfluous include that will not work in plain Splunk I have the current 0.1.2 up on github though (i installed a prtg at home so i can check it out) https://github.com/dominiquevocat/TA-prtg

dominiquevocat · ‎09-29-2016

You might be able to make use of this app: https://splunkbase.splunk.com/app/2775/

dominiquevocat · ‎09-26-2016

You might be able to make use of this app: https://splunkbase.splunk.com/app/2775/

dominiquevocat · ‎09-26-2016

I will need to run it on a test instance to try to reprodice the issues...

dominiquevocat · ‎09-24-2016

not sure, is the prtg.conf in the \local Directory?

dominiquevocat · ‎09-23-2016

hi, are at the .conf? I am arround already and i suppose we can have a look. I wound need to see what is your environment and how it differs 😞 - we run splunk on linux and the prtg version we use is the 16.1.21.1924+ what you can try is see if you can access for instance the historic data using the relative url /api.htm?tabid=3 There you can run sample reports. That is what the custom command does. Next try to get that webpage from the searchhead using wget or curl using your user and password. If that works then i i don't know whats wrong. For your refenrence: you can see the searches the dashboard items run. So for instance to see the alarms the dashboard runs: | prtglivedata content="sensors" filter_status=5 count=100 | table _time,device,group,message,sensor,status,objid content="" usually maps directly the the items as seen in the api.htm i.e. endpoints of the api.

Posts	292
Solutions	20
Karma Given	26
Karma Received	57
Member Since	‎08-26-2010

Online Status	Offline
Date Last Visited	‎07-08-2026 12:28 PM

commands against localhost?

Splunk_TA_mcafee-wg fields wrong?

difficulty in updating a lookup file via rest

How to write/create permission under /etc from pyt...

How do I go about sending multi-lined string varia...

Splunk REST API: Issue wtih flattening JSON-format...

package deployment-app via CLI or rest

DB Connect 2 and Firebird SQL

persist settings per logged in user in a controlle...

Merging local into default using git?

Re: Monitoring Novell eDirectory events with Splun...

Re: Is there a way to run a script residing in a b...

Is there a way to run a script residing in a bin f...

Re: What is the process to run the TA-prtg Add-on?

Re: How to generate a proper timestamp on events?

Re: How to generate a proper timestamp on events?

How to generate a proper timestamp on events?

Re: Rest API and Jquery AJax Requests do not work

HomeAssistant app for Splunk: How to resolve "Erro...

Re: Forwarder REST API: How can I get the list of ...

Re: How do you disable the REST API endpoint servi...

How to get a developer license for Splunk IT Servi...

Re: Is it possible to have a custom REST endpoint ...

set deploy-poll via rest

Re: How to troubleshoot why Splunk Enterprise won'...

Re: What is the process to run the TA-prtg Add-on?

Re: Why is the TA-forwarderquery Add-on missing fi...

Re: What is the process to run the TA-prtg Add-on?

Re: What is the process to run the TA-prtg Add-on?

Re: What is the process to run the TA-prtg Add-on?

Re: Restart a UF via CLI / other remote means

Re: Unable to remotely restart universal forwarder

Re: What is the process to run the TA-prtg Add-on?

Re: What is the process to run the TA-prtg Add-on?

Re: What is the process to run the TA-prtg Add-on?

Join the Conversation