Deployment Architecture

How to run a linux command on remote machine via splunk GUI, on demand only?

smitapatankarso
Explorer

I have splunk instance running on one linux server.
I have python code on another linux server, which I run manually something like:

(console script command given in setup.py) (arguments)
Is it possible to run this via Splunk GUI? If so, how?

Note:
This is to be run on demand and not in a scheduled way i.e. whenever user searches say a username from splunk GUI, python script from remote server needs to run, fetch some details and send back as results for the search.

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

Sounds like you need a custom search command or external lookup. These links should get you started:

External Lookups: https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/Configureexternallookups
Custom Search Command Docs: https://docs.splunk.com/Documentation/Splunk/8.0.1/Search/Writeasearchcommand
Custom Search Command Dev: https://dev.splunk.com/enterprise/docs/developapps/customsearchcommands/

What kind of details does the script return? What does the script do? An example of an external search command is in Splunk Supporting Add-on for Active (https://splunkbase.splunk.com/app/1151/). Given different arguments it will return LDAP user/object results to supplement results or create lookup tables.

More details are likely needed to determine the best way to do this. There isn't really a simple "out of the box" way to do this.

smitapatankarso
Explorer

Thanks I will go through the provided information.

The script needs to take a username as input (via splunk GUI).
It then needs to form a list of all the groups the user is a part of recursively, by communicating with Redis server which has raw information of users and groups.
It needs to return that list of groups to be displayed as splunk search result.

splunk(splunk server)<-->server that has script<-->redis server

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...