cant post links so just search for freeload101 github for updated code #!/bin/bash ########################## FUNC function UFYUM(){ cd /tmp rpm -Uvh --nodeps `curl -s https://www.splunk.com/en_us/download/universal-forwarder.html\?locale\=en_us | grep -oP '"https:.*(?<=download).*x86_64.rpm"' |sed 's/\"//g' | head -n 1` yum -y install splunkforwarder.x86_64 sleep 5 } function UFDEB(){ cd /tmp wget `curl -s https://www.splunk.com/en_us/download/universal-forwarder.html\?locale\=en_us | grep -oP '"https:.*(?<=download).*amd64.deb"' |sed 's/\"//g' | head -n 1` -O amd64.deb dpkg -i amd64.deb sleep 5 } function UFConf(){ mkdir -p /opt/splunkforwarder/etc/apps/nwl_all_deploymentclient/local/ cd /opt/splunkforwarder/etc/apps/nwl_all_deploymentclient/local/ cat <<EOF> /opt/splunkforwarder/etc/apps/nwl_all_deploymentclient/local/app.conf [install] state = enabled [package] check_for_updates = false [ui] is_visible = false is_manageable = false EOF cat <<EOF> /opt/splunkforwarder/etc/apps/nwl_all_deploymentclient/local/deploymentclient.conf [deployment-client] phoneHomeIntervalInSecs = 60 [target-broker:deploymentServer] targetUri = XXXXXXXXXXXXXXXXXXXXXXX:8089 EOF cat <<EOF> /opt/splunkforwarder/etc/system/local/user-seed.conf [user_info] USERNAME = admin PASSWORD = XXXXXXXXXXXXXXXXXXXXXXXX EOF /opt/splunkforwarder/bin/splunk cmd btool deploymentclient list --debug /opt/splunkforwarder/bin/splunk start --accept-license } ######################################################### MAIN # Check for RPM package managers if command -v yum > /dev/null; then UFYUM UFConf else echo "No YUM package manager found." fi # Check for DEB package managers if command -v dpkg > /dev/null; then UFDEB UFConf else echo "No DEB package manager found." fi ... View more

  #!/bin/bash ########################## FUNC function UFYUM(){ cd /tmp rpm -Uvh --nodeps `curl -s https://www.splunk.com/en_us/download/universal-forwarder.html\?locale\=en_us | grep -oP '"https:.*(?<=download).*x86_64.rpm"' |sed 's/\"//g' | head -n 1` yum -y install splunkforwarder.x86_64 sleep 5 } function UFDEB(){ cd /tmp wget `curl -s https://www.splunk.com/en_us/download/universal-forwarder.html\?locale\=en_us | grep -oP '"https:.*(?<=download).*amd64.deb"' |sed 's/\"//g' | head -n 1` -O amd64.deb dpkg -i amd64.deb sleep 5 } function UFConf(){ mkdir -p /opt/splunkforwarder/etc/apps/nwl_all_deploymentclient/local/ cd /opt/splunkforwarder/etc/apps/nwl_all_deploymentclient/local/ cat <<EOF> /opt/splunkforwarder/etc/apps/nwl_all_deploymentclient/local/app.conf [install] state = enabled [package] check_for_updates = false [ui] is_visible = false is_manageable = false EOF cat <<EOF> /opt/splunkforwarder/etc/apps/nwl_all_deploymentclient/local/deploymentclient.conf [deployment-client] phoneHomeIntervalInSecs = 60 [target-broker:deploymentServer] targetUri = XXXXXXXXXXXXXXXXXXXXXXX:8089 EOF cat <<EOF> /opt/splunkforwarder/etc/system/local/user-seed.conf [user_info] USERNAME = admin PASSWORD = XXXXXXXXXXXXXXXXXXXXXXXX EOF /opt/splunkforwarder/bin/splunk cmd btool deploymentclient list --debug /opt/splunkforwarder/bin/splunk start --accept-license } ######################################################### MAIN # Check for RPM package managers if command -v yum > /dev/null; then UFYUM UFConf else echo "No YUM package manager found." fi # Check for DEB package managers if command -v dpkg > /dev/null; then UFDEB UFConf else echo "No DEB package manager found." fi ... View more

got nasty gram for posting links search online for freeload101 github   in scripts Splunk_UniversalForwarder_Installer.bash got nasty gram for posting links search online for freeload101 github in scripts Splunk_UniversalForwarder_Installer.bash ... View more

got nasty gram for posting links search online for freeload101 github   in scripts Splunk_UniversalForwarder_Installer.bash ... View more

got nasty gram for posting links search online for freeload101 github in scripts Splunk_UniversalForwarder_Installer.bash ... View more

  got nasty gram for posting links search online for freeload101 github in scripts Splunk_UniversalForwarder_Installer.bash ... View more

got nasty gram for posting links search online for freeload101 github in scripts nmap_fruit.sh ... View more

got nasty gram for posting links search online for freeload101 github in scripts nmap_fruit.sh ... View more

got nasty gram for posting links search online for freeload101 github in scripts nmap_fruit.sh  ... View more

  got nasty gram for posting links search online for freeload101 github in scripts nmap_fruit.sh ... View more

nmap XML to SPLUNK HEC !!!    https://github.com/freeload101/SCRIPTS/blob/b3f83288a9f289d86f6cdd04898478d0427097ce/Bash/NMAP_FRUIT.sh#L80     ... View more

nmap XML to SPLUNK HEC !!!  https://github.com/freeload101/SCRIPTS/blob/b3f83288a9f289d86f6cdd04898478d0427097ce/Bash/NMAP_FRUIT.sh#L80   ... View more

XtremeNmapParser FTW to convert the xml to JSON and then used HEC to send it all to Spunk! https://github.com/xtormin/XtremeNmapParser/issues/1 ... View more

 XtremeNmapParser ! to convert the xml to JSON and then used HEC to send it all to Spunk! https://github.com/xtormin/XtremeNmapParser/issues/1 ... View more

I used XtremeNmapParser from github to convert the xml to JSON and then used HEC to send it all to Spunk! https://github.com/xtormin/XtremeNmapParser/issues/1 ... View more

I used the XtremeNmapParser to convert the xml to JSON and then used HEC to send it all to Spunk! https://github.com/xtormin/XtremeNmapParser/issues/1 ... View more

I used XtremeNmapParser to convert the xml to JSON and then used HEC to send it all to Spunk! https://github.com/xtormin/XtremeNmapParser/issues/1 Z ... View more

I used XtremeNmapParser to convert the xml to JSON and then used HEC to send it all to Spunk! https://github.com/xtormin/XtremeNmapParser/issues/1 ... View more

Looking into this now ... I have dumped a sample of every single table and trying to figure out the API and filters as we have null values for like 90% of our asssets in SNOW so I need to filterout and some how bind IP <> Owner .. some notes ...      roll thouth all the tgables "get the table names in the UI by going to report crate page ... and looking at the source curl -s -H "Accept: application/json" -u "XXXXXXXXXXXXXX:XXXXXXXX" "https://YOURCOMPANEYNAME.service-now.com/api/now/table/${i}?sysparm_display_value=all&sysparm_offset=${j}&sysparm_limit=1000" -o "${i}_out${j}.json" look for non null values for each key ? ( for me YMMV ) grep -E "(\bip.address\b|\bsupport.group\b|owned_by\b|\bsys_class_name\b|\blocation\b|\bsys_class_name\b|\bdns_domain\b|\bsys_domain\b|\bfqdn\b|\bbusines_criticality\b|\bclass_name\b|\boperational_status\b|\bcreated_by\b|\bassignment_group\b|\bassigned_to\b|\bsvc_service_id\b)" Pretty_* -A 1 Working on filtering like &not%20owned_by="" or something .. I have no idea hopfuly sometihng on github that uses this API with filtering so ill post or mesg me - rmccurdy.com ... View more