| # - https://docs.splunk.com/Documentation/Splunk/latest/Data/AboutHECIDXAck | |
| # - https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector | |
| # - https://docs.splunk.com/Documentation/Splunk/latest/Data/HECExamples | |
| # NOTE: events sent to the RAW endpoint will land in the default index for the provided token | |
| # event endpoint [ack disabled] | |
| curl -k \ | |
| -H "Authorization: Splunk TH1S-IS-N0T-A-R3AL-T0K3N" \ | |
| https://splunk-heavyforwarder:8088/services/collector/event \ |
This SPL will generate a list of HEC token strings that you could copy pasta straight into an inputs.conf (although testing & validation is always wise).
Useful if you are trying to replicate Splunk Cloud HEC tokens to Heavy Forwarders.
Example output:
[<token title>]
description = <description, (if blank, title)>
disabled = 0
index = index_1
| import secrets | |
| import datetime | |
| import time | |
| import requests | |
| # send a random splunk string to a http event collector | |
| # includes some fake app names and environments | |
| # generates len(app_names) events every 10 seconds | |
| requests.packages.urllib3.disable_warnings() |
In this mode your script runs not on the server, but locally on your machine, so that you can pause and debug it.
Don't know how to code in JavaScript? Check out this free interactive course!
| Set-PSDebug -Off | |
| # splunk service details | |
| $splunkService = "SplunkForwarder" | |
| # path to splunk configs | |
| $splunk_serverconf = 'C:\Program Files\SplunkUniversalForwarder\etc\system\local\server.conf' | |
| $splunk_inputsconf = 'C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf' | |
| # get current computername |
the otel collector is a reasonably nice way to scrape prometheus enpoints
it is obviously designed for use with splunk's olly cloud, but the otel collector supports output to splunk hec tokens as well.
im running multiple docker containers (to seperate workloads).
first, create configs
| #!/usr/bin/python3 | |
| # a quick and dirty dns test script | |
| # checks to see if we can resolve a list of hosts | |
| # writes to the hec endpoint on the localhost | |
| # (expected to be run from hfw) | |
| # | |
| # cron: * * * * * /root/dnstest.py >/tmp/dnstest.out 2>&1 | |
| # | |
| # [email protected] |
| #!/usr/bin/env bash | |
| # set -euxo pipefail | |
| # ---- | |
| # | |
| # report ip address changes to slack channel | |
| # | |
| # this script detects and reports ip address changes | |
| # to me via personal slack message. | |
| # |
| abandoned | |
| able | |
| absolute | |
| adorable | |
| adventurous | |
| academic | |
| acceptable | |
| acclaimed | |
| accomplished | |
| accurate |
| TZ="Australia/Brisbane" | |
| SPLUNK_ENDPOINT="https://myendpoint.splunkcloud.com:8089" | |
| SPLUNK_USERNAME="splunkusername" | |
| SPLUNK_PASSWORD="splunkpassword" | |
| SPLUNK_APP="splunkapp" |