Is it possible to switch off forwarder from web?

[splunker_123]

Hi

Does splunk web have an option to switch off the universal forwader that is installed on a remote machine and sending data to the indexer?

We've more than 80 forwarders installed on different Linux machines.Its a pain to stop and start each time when the testers need to do Load and stress testing.Is there a single console access to manage forwarders?
Thanks

[MHibbin]

Hi,

Basically, no, well not that I have ever seen.

If it was me I would approach the task with a custom command that has a background script which will remotely stop/start the service depending on the arguments used. Although this is not the intended usage of these commands, it does provide an on-demand solution. I recently had to set some stuff up like this and it works fine (well similar, wanted to control server-side files from webUI).

After you have created the command, you could run a search like so..

|metadata type=hosts | remoteControl stop hostIP

I have used metadata as it is not a "heavy" search, it is then piped to a custom command, which in this case is "remoteControl", and it has the argument "stop" which could also be "start" or "restart" m and then you have the IP address of the remote host.

These arguments are then taken in by the script as "$1" and "$2" respectively (python at least). And you can then manipulate as you like.

UPDATE:

The following is just a guide and has not been properly tested, so maybe use on a test system.

import subprocess
# used for calling CLI commands
import sys
# used for collecting script arguments
import re
# used for regex

# Assign arguments to variables
control=sys.argv[1]
host=sys.argv[2]
user=sys.argv[3]

# Example of how to compile the log in for SSH
auth=user + "@" + host

# Define regular expression for checking valid dotted decimal IP, and set test on host
pat = re.compile(r'^\d+\.\d+\.\d+\.\d+$')
test = pat.match(host)

# Check if control is on
if control == "on":
        # Check valid IP
        if test:
                print "Switching " + host + " on, via user: " + auth
                # This calls the CLI level command, I have used ls as simple test..
                # .. As I currently don't have access to check much more
                # .. However this should get you started..
                subprocess.Popen(['ls','-l'])
        else:
                print "Wrong host value: must be in dotted decimal format"
# Check if control is off
elif control == "off":
        # Check valid IP
        if test:
                print "Switching " + host + " off, via user: " + auth
                subprocess.Popen(['ls','-l'])
        else:
                print "Wrong host value: must be in dotted decimal format"
# Check if control is anything else
else:
        print "Wrong control value: must be 'on' or 'off'"  

If you save this file somewhere, you do the following from the directory of the file (where $SPLUNK_HOME should be you Splunk install location from root directory (e.g. /opt😞

$SPLUNK_HOME/bin/splunk cmd python yourScript.py control host user

This will allow to test the python script useing Splunk's version of Python (2.7), this will currently just do an ls -l but it should get you started. The python docs are very useful, and for python questions you can ask over "StackOverflow" very useful forum. Splunk related obviously still here. Hope this helps get you started!!!!

P.S this current script will only work on nix like systems, due to the command, if you were using windows you could do dir instead (for this example)

P.P.S if this has answered your question please mark as accepted.Thanks

[MHibbin]

Also with python... it has been designed with "readability" in mind, so spacing matters, so you must use correct identing and spacing.

[MHibbin]

@splunker_123, Hi, sorry, I've been real busy on project stuff, please see update above...

[splunker_123]

Anyone please?

[splunker_123]

I'm looking for some inspiration for writing a python script as you said above because I'm pretty much new to scripting.Do you have any skeleton that I can use?

Thanks

[MHibbin]

Also, if this has answered you question could please accept the answer using the tick to the left of the answer, this will tell the kind people that use Splunkbase that your question has been answered (I notice you have a lot of question which have answers that haven't been accepted.

Cheers,

MHibbin

[MHibbin]

What you could do is set up an ssh key exchange and use that, so that you don't have to authenticate on a per usage basis (as this would be automated). This is a common practice and there are many Nix guides on creating keys, and setting up the authentication so user running the script (i.e. the user running Splunk), does not need to input a password. A possible link to try: http://oreilly.com/pub/h/66

[splunker_123]

So does that mean I have to manage the login and authentication to remote servers in the python scripts?

I meant the ssh2 login between the linux servers should be managed through scripts?

Thanks