Thanks. I suspected so, but was hoping there was another method. Unfortunately we don't have any distinguishing elements outside of the sourcetypes we're setting. I'll place an enhancement request to at least allow simple pattern matching for sourcetypes within props. ... View more

I actually ended up having to specify each user's sAMAccountName within the "userBaseFilter". Fortunately I was able to write a script to generate groupBaseDN, groupBaseFilter, userBaseDN, and userBaseFilter by wrapping the Solaris ldapsearch. The goal is to automate that portion so that Splunk access can be inherited through the AD Group, distribution list, or mailbox member. Here is the pilot script. The final one should actually build the authentication.conf, reload auth, set user defaults relative to roles (i.e. set the default application relative to user and role), and be managed through a configuration file. Use Splunk cron scheduler to run once or twice a week. #!/usr/bin/perl my(@domains) = ( '<domain label 1> ', '<domain label 2> ', '<domain label n> ', ); my(%cfgs); if(@ARGV) { push(@{$cfgs{adGroups}},@ARGV); } else { @{$cfgs{adGroups}} = ( '<AD Group sAMAccountName 1>', '<AD Group sAMAccountName 2>', '<AD Group sAMAccountName n>', ); } %{$cfgs{adBindParameters}} = ( '<domain label 1>' => { 'cn' => 'CN=<...>,OU=<...>,DC=<....>,DC=com', 'pw' => '<Bind Password>', 'dc' => '<Domain Controller or LDAP Host>', 'pt' => '<port>', 'tr' => '<Top OU of Search Path>' }, '<domain label 2>' => { ........... } '<domain label n>' => { ........... } ); my($regex) = '^CN=[^,]+,[^,]+,\s*?(OU\=[^$]+)$'; foreach my $domain (@domains) { print "##\n## [[$domain]]----------------------------\n##\n"; my(@userBaseDN); my(@groupBaseDN); my($groupList); my($userBaseFilter) = '(|'; my($groupBaseFilter) = '(|'; foreach my $group (@{$cfgs{adGroups}}) { my($memberList); my($cmd) = ( '/usr/bin/ldapsearch' . ' -v' . ' -x' . ' -h "' . $cfgs{adBindParameters}{$domain}{dc} . '"' . ' -p "' . $cfgs{adBindParameters}{$domain}{pt} . '"' . ' -b "' . $cfgs{adBindParameters}{$domain}{tr} . '"' . ' -D "' . $cfgs{adBindParameters}{$domain}{cn} . '"' . ' -w "' . $cfgs{adBindParameters}{$domain}{pw} . '"' . ' "(sAMAccountName=' . $group . ')"' . ' -W "member"' ); #--------------------------------------------------------------# # Grab DN for each group member and DN for evaluated AD group. # #--------------------------------------------------------------# if(open(adInfo,"$cmd|")) { my($memberJoinFlag); my($groupJoinFlag); while(<adInfo>) { s/^\s+|\s+$//g; s/\\/\\\\\\\\/gm; if(/^member:\s*(.*)/) { $memberJoinFlag = 1; $memberList .= "\n$1"; } elsif(/^dn:\s*(.*)/) { $groupJoinFlag = 1; $groupList .= "\n$1"; } elsif($memberJoinFlag && !/^[\d]+\smatches/) { $memberJoinFlag; $memberList .= $_; } elsif($groupJoinFlag && !/^[\d]+\smatches/) { $groupJoinFlag; $groupList .= $_; } } close(adInfo); } #---------------------------------------------------------------# # Determine each member's UID (sAMAAccountName) from DN. Build # # 'userBaseFilter and 'groupBaseFilter' # #---------------------------------------------------------------# my(@memberDNs) = split("\n",$memberList); my($duplicate); foreach my $member (@memberDNs) { if($member =~ /$regex/) { my($ou) = $1; my($dupeKey) = $ou; $dupeKey =~ s/[\W]//gm; unless(defined $duplicate{$dupeKey}) { push(@userBaseDN,"$ou"); } $duplicate{$dupeKey} = 1; } $cmd = ( '/usr/bin/ldapsearch' . ' -v' . ' -x' . ' -h "' . $cfgs{adBindParameters}{$domain}{dc} . '"' . ' -p "' . $cfgs{adBindParameters}{$domain}{pt} . '"' . ' -b "' . $cfgs{adBindParameters}{$domain}{tr} . '"' . ' -D "' . $cfgs{adBindParameters}{$domain}{cn} . '"' . ' -w "' . $cfgs{adBindParameters}{$domain}{pw} . '"' . ' "(distinguishedName=' . $member . ')"' . ' -W "sAMAccountName"' ); if(open(adInfo,"$cmd|")) { while(<adInfo>) { s/^\s+|\s+$//g; if(/^sAMAccountName:\s*([\w]+)$/) { my($userAcctName) = uc($1); if( ($userAcctName =~ /^[aAuU][aA-zZ,0-9]{6}$/) && (!defined $duplicate{$userAcctName}) ) { $userBaseFilter .= "(sAMAccountName=$userAcctName)"; } unless(defined $duplicate{$group}) { $groupBaseFilter .= "(sAMAccountName=$group)"; } $duplicate{$userAcctName} = 1; $duplicate{$group} = 1; } } close(adInfo); } } } $groupBaseFilter .= ')'; $userBaseFilter .= ')'; #-----------------------------------------------------------# # Determine a list of all OU search paths for "groupBaseDN" # #-----------------------------------------------------------# my(@groupDNs) = split("\n",$groupList); my(%duplicate); foreach(@groupDNs) { if(/$regex/) { my($ou) = $1; my($dupeKey) = $ou; $dupeKey =~ s/[\W]//gm; unless(defined $duplicate{$dupeKey}) { push(@groupBaseDN,"$ou"); } $duplicate{$dupeKey} = 1; } } print "groupBaseDN = " . join(';',@groupBaseDN) . "\n\n"; print "groupBaseFilter = $groupBaseFilter\n\n"; print "userBaseDN = " . join(';',@userBaseDN) . "\n\n"; print "userBaseFilter = $userBaseFilter\n\n"; } __END__ ... View more

For various reasons we don't have a viable software distribution system. To get around that we leveraged a few open source tools and wrote a few cmd scripts. [Tools] blat.exe psexec.exe [Overall Iterative Install/Uninstall Wrapper] echo off set runPath=%~dp0 set hostsFile=targetHosts.txt set adminName=%1 set adminPass=%2 set action=%3 set cmdExe=c:\winnt\system32\cmd.exe /C set installerPath=\\<host>\<share>$\<subPath> set installCmd=%cmdExe% %installerPath%\splunkForwarderInstall.cmd set uninstallCmd=%cmdExe% %installerPath%\splunkForwarderUninstall.cmd if "%adminName%"=="" GOTO USAGE if "%adminPass%"=="" GOTO USAGE if "%action%"=="install" GOTO INSTALL if "%action%"=="uninstall" GOTO UNINSTALL GOTO USAGE :INSTALL echo Installing Splunk Forwarders: echo CMD: %runPath%psexec @%runPath%%hostsFile% -u %adminName% -p %adminPass% %installCmd% %runPath%psexec @%runPath%%hostsFile% -u %adminName% -p %adminPass% %installCmd% GOTO EOF :UNINSTALL echo Uninstalling Splunk Forwarders: echo CMD: %runPath%psexec @%runPath%%hostsFile% -u %adminName% -p %adminPass% %uninstallCmd%" %runPath%psexec @%runPath%%hostsFile% -u %adminName% -p %adminPass% %uninstallCmd%" GOTO EOF :USAGE echo "%0 <adminName> <adminPass> <install|uninstall>" :EOF pause [Installer CMD Script] @echo off rem Identify execution path set runPath=%~dp0 rem Define installation constants set installPath=<Target Installation Path> set installPkg=splunk-<version>-release.msi rem Define SMTP messaging constants. For multiple message recipients, rem define a comma (,) seperated list of SMTP addresses in %smtpRecip% set smtpSrvr=<SMTP Gateway Server> set smtpPort=<SMTP Server Port> set smtpRecip=<SMTP Recipient Addresses> set smtpSub=Splunk Forwarder Installation set smtpBody=%installPath%\..\smtpBody.txt set installer=%runPath%%installPkg% echo =============================================== >> %smtpBody% echo [+] Grab simple host and user information > %smtpBody% mkdir %installPath% >> %smtpBody% mkdir %installPath%\etc\apps\DeployClientInfo >> %smtpBody% echo %USERNAME% >> %smtpBody% echo %COMPUTERNAME%.%USERDNSDOMAIN% >> %smtpBody% ipconfig >> %smtpBody% echo =============================================== >> %smtpBody% set msiCmd=msiexec.exe /log %installPath%\SplunkInst.log /i "%installer%" INSTALLDIR="%installPath%" SPLUNK_APP="" /passive echo [+] Install Splunk Forwarder >> %smtpBody% echo : %msiCmd% >> %smtpBody% msiexec.exe /log %installPath%\SplunkInst.log /i "%installer%" INSTALLDIR="%installPath%" SPLUNK_APP="" /passive >> %smtpBody% copy %installPath%\etc\splunk-forwarder.license %installPath%\etc\splunk.license >> %smtpBody% echo =============================================== >> %smtpBody% echo [+] Shutdown Splunk services and disable Splunk Web >> %smtpBody% sc stop Splunkweb >> %smtpBody% sc config Splunkweb start= disabled >> %smtpBody% sc stop Splunkd >> %smtpBody% echo =============================================== >> %smtpBody% echo [+] Copy confiturations over those deployed by the msi installer >> %smtpBody% xcopy %runPath%Splunk %installPath% /Y /R /H /S >> %smtpBody% echo =============================================== >> %smtpBody% echo [+] Start up the Splunkd service >> %smtpBody% sc start Splunkd >> %smtpBody% echo =============================================== >> %smtpBody% echo [+] Complete... >> %smtpBody% echo [+] See "%installPath%\SplunkInst.log" for installation details >> %smtpBody% echo [+] Notifying the Splunk administrators about the installation >> %smtpBody% "%runPath%blat.exe" "%smtpBody%" -server "%smtpSrvr%" -port "%smtpPort%" -f "%USERNAME%@%COMPUTERNAME%.%USERDNSDOMAIN%" -t "%smtpRecip%" -s "%smtpSub%" -attach "%installPath%\SplunkInst.log" rem Cleanup trace file del %smtpBody% [Uninstaller CMD Script] @echo off rem Identify execution path set runPath=%~dp0 rem Define installation constants set installPath=<Target Installation Path> set installPkg=splunk-<version>-release.msi rem Define SMTP messaging constants. For multiple message recipients, rem define a comma (,) seperated list of SMTP addresses in %smtpRecip% set smtpSrvr=<SMTP Gateway Server> set smtpPort=<SMTP Server Port> set smtpRecip=<SMTP Recipient Addresses> set smtpSub=Splunk Forwarder Installation set smtpBody=%installPath%\..\smtpBody.txt set installer=%runPath%%installPkg% echo =============================================== >> %smtpBody% echo [+] Grab simple host and user information > %smtpBody% echo %USERNAME% >> %smtpBody% echo %COMPUTERNAME%.%USERDNSDOMAIN% >> %smtpBody% ipconfig >> %smtpBody% echo =============================================== >> %smtpBody% echo [+] Shutdown Splunk services and disable Splunk Web >> %smtpBody% sc stop Splunkweb >> %smtpBody% sc stop Splunkd >> %smtpBody% echo =============================================== >> %smtpBody% echo [+] Uninstall Splunk Forwarder >> %smtpBody% echo : msiexec.exe /x "%installer%" /passive >> %smtpBody% msiexec.exe /x "%installer%" /passive >> %smtpBody% echo =============================================== >> %smtpBody% echo [+] Complete... >> %smtpBody% echo [+] See "%installPath%\SplunkInst.log" for installation details >> %smtpBody% echo [+] Notifying the Splunk administrators about the installation >> %smtpBody% "%runPath%blat.exe" "%smtpBody%" -server "%smtpSrvr%" -port "%smtpPort%" -f "%USERNAME%@%COMPUTERNAME%.%USERDNSDOMAIN%" -t "%smtpRecip%" -s "%smtpSub%" rem Cleanup trace file del %smtpBody% It took me about 5-10 minutes to install the forwarders across 40 servers. As part of the installation package, we pre-created all of the splunkd configurations (deployment client, logging) which are copied as part of the installation. Our particular installation we made sure to disable SplunkWeb, and have splunkd check into our deployment server for all monitoring details. This includes the instructions as to which index server/s to connect to. ... View more