acharlieh

# -*- mode: ruby -*-
# vi: set ft=ruby :

@boxes = {
  centos510: {box:'opscode_centos-5.10_provisionerless',box_url:'http://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-5.10_chef-provisionerless.box'},
  centos65: {box:'opscode_centos-6.5_provisionerless',box_url:'http://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-6.5_chef-provisionerless.box'},
}

Vagrant.configure('2') do |config|
  config.berkshelf.enabled = false

acharlieh

# -*- mode: ruby -*-
# vi: set ft=ruby :

@boxes = {
  centos510: {box:'opscode_centos-5.10_provisionerless',box_url:'http://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-5.10_chef-provisionerless.box'},
  centos65: {box:'opscode_centos-6.5_provisionerless',box_url:'http://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-6.5_chef-provisionerless.box'},
}

Vagrant.configure('2') do |config|
  config.berkshelf.enabled = false

acharlieh

This is a Gist of useful Splunk Queries.

acharlieh

| noop | stats count | fields 
| eval num=mvrange(0,40,1) | mvexpand num 
| eval _time=relative_time(now(),"-".num."d@d")
| eval day=strftime(_time,"%A - %F") 
| timechart span=w count,list(day)

Have your search time range be at least: earliest=-40d@d latest=now otherwise you confuse the embedded bucket command by presenting data that's not in the time range.

acharlieh

index=yourindexes sourcetype=access_combined uri_path=/login
| eval _time=relative_time(_time,"@m") 
| stats count by clientip,_time 
| where count > X 
| appendpipe 
  [ dedup clientip
  | map 
    [ gentimes increment=1m 
      [ noop 
      | stats count 

acharlieh

perl -ne " if (/^(version\s+'\d+\.\d+\.)(\d+)('.*)/) { \$fix = \$2 + 1; print \"\$1\$fix\$3\n\" } else { print }" metadata.rb

acharlieh

import java.net.URI;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

//You'll need: https://github.com/OfficeDev/ews-java-api/

import microsoft.exchange.webservices.data.core.ExchangeService;
import microsoft.exchange.webservices.data.core.PropertySet;
import microsoft.exchange.webservices.data.core.service.folder.Folder;
import microsoft.exchange.webservices.data.core.service.item.Item;

acharlieh

| noop 
| stats count 
| fields 
| eval raw=split("a=3 b=9 ; a=5 b=1 ; a=10 b=10 ; a=5 b=8 ; a=3 b=1 ; a=6 b=9 ; a=4 b=9 ; a=3 b=1 ; a=7 b=7 ; a=5 b=9 ; a=6 b=10 ; a=7 b=10 ; a=6 b=7 ; a=1 b=8 ; a=8 b=7 ; a=6 b=6 ; a=3 b=7 ; a=2 b=8 ; a=9 b=3 ; a=5 b=2 ; a=5 b=8 ; a=8 b=10 ; a=10 b=7 ; a=6 b=1 ; a=2 b=4 ; a=5 b=7 ; a=9 b=5 ; a=6 b=7 ; a=9 b=6 ; a=4 b=10 ; a=10 b=7 ; a=7 b=7 ; a=6 b=6 ; a=6 b=3 ; a=2 b=9 ; a=2 b=7 ; a=2 b=5 ; a=3 b=9 ; a=3 b=9 ; a=1 b=5 ; a=5 b=7 ; a=5 b=3 ; a=6 b=6 ; a=10 b=9 ; a=3 b=2 ; a=10 b=8 ; a=1 b=4 ; a=4 b=4 ; a=2 b=4 ; a=9 b=4 ; a=2 b=1 ; a=3 b=6 ; a=2 b=3 ; a=1 b=9 ; a=10 b=6 ; a=2 b=6 ; a=3 b=3 ; a=10 b=6 ; a=3 b=5 ; a=2 b=5 ; a=5 b=5 ; a=6 b=4 ; a=5 b=5 ; a=6 b=10 ; a=4 b=8 ; a=5 b=1 ; a=3 b=1 ; a=3 b=7 ; a=3 b=4 ; a=6 b=10 ; a=1 b=8 ; a=9 b=9 ; a=8 b=4 ; a=7 b=8 ; a=7 b=9 ; a=1 b=3 ; a=9 b=8 ; a=2 b=3 ; a=7 b=1 ; a=2 b=8 ; a=6 b=3 ; a=6 b=6 ; a=1 b=3 ; a=7 b=1 ; a=8 b=1 ; a=10 b=5 ; a=7 b=6 ; a=2 b=8 ; a=1 b=4 ; a=8 b=6 ; a=5 b=10 ; a=10 b=7 ; a=7 b=4 ; a=10 b=4 ; a=5 b=9 ; a=8 b

acharlieh

require 'chef-vault'
data = JSON.parse(File.open('data_bags/cerner_splunk/license_secrets_keys.json').read())

keys = (data['clients'] + data['admins']).inject({}) do |m,c|
  pem = (c == 'knife_workstation') ? 'fake-key.pem' : "pems/#{c}.pem"
  private_key = OpenSSL::PKey::RSA.new(File.open(pem).read())
  m[c] = private_key.private_decrypt(Base64.decode64(data[c]))
  m
end

acharlieh

require 'json'

# Cookbooks from a folder (like when you do a berks vendor)
# json = Dir.glob('./*/metadata.json').collect do |file|

# Cookbooks from a node cache
json = Dir.glob('/var/chef/cache/cookbooks/*/metadata.json').collect do |file|
  hash = JSON.parse(File.read(file))
  { hash['name'] => hash['version'] }
end.reduce({}, :merge).to_json