Hal Rottenberg halr9000

How to make fake data in Splunk using SPL

Sometimes, you need to fake something in Splunk. Might be during development and you don't feel like writing a real search, but you really need a number for a dashboard panel to look right. Maybe you are helping someone with a hairy regex, and you don't want to index data just to test it on your instance. Whatever the reason, here are some searches that have helped me out.

Note that when using these techniques, you are not going through the indexing

	xExchActiveSyncVirtualDirectory xExchAutodiscoverVirtualDirectory
	xExchAutoMountPoint xExchClientAccessServer
	xExchDatabaseAvailabilityGroup xExchDatabaseAvailabilityGroupMember
	xExchDatabaseAvailabilityGroupNetwork xExchEcpVirtualDirectory
	xExchExchangeCertificate xExchExchangeServer
	xExchImapSettings xExchMailboxDatabase
	xExchMailboxDatabaseCopy xExchMapiVirtualDirectory
	xExchOabVirtualDirectory xExchOutlookAnywhere
	xExchOwaVirtualDirectory xExchPopSettings
	xExchPowerShellVirtualDirectory xExchReceiveConnector

	FROM centos:latest
	MAINTAINER [email protected]
	EXPOSE 8000 8089 9997 9887 8191
	ADD splunk/ /opt/splunk/
	VOLUME ["/opt/splunk/var/lib"]
	CMD ["/opt/splunk/bin/splunk", "start", "--nodaemon", "--accept-license", "--no-prompt", "--answer-yes", "--auto-ports"]

	Install-WindowsUpdate
	Enable-RemoteDesktop

	cinst git-credential-winstore
	cinst console-devel
	cinst sublimetext3
	cinst poshgit
	cinst google-chrome-x64
	cinst AWSTools.Powershell

	<#
	.Synopsis
	Returns XML object for local stream forwarder configuration if it exists, or optionally, default configuration.
	.DESCRIPTION
	Long description
	.EXAMPLE
	Get-StreamForwarderConfigXml -DefaultConfig

	xml CmConfig
	--- --------

	# Get script path (works on v2+ of PowerShell) http://stackoverflow.com/a/5466355. v3+ has $PSScriptRoot variable, but win2k3 boxes might not have v3.
	$scriptPath = split-path -parent $MyInvocation.MyCommand.Definition
	Write-Verbose "Script Path: $scriptPath"

	# find $SPLUNK_HOME starting from the bin path for an app, e.g. $env:programfiles\Splunk\etc\apps\appname\bin\test.ps1
	# could just use string concatenation, but using the Resolve-Path and Join-Path cmdlets here will generate useful errors if they fail
	$SPLUNK_HOME = Resolve-Path ( Join-Path -Path $scriptPath -ChildPath "..\..\..\.." ) # if my relative path is right?
	Write-Verbose "Splunk Home: $splunk_home"

	$SPLUNK_BIN = Join-Path -Path $SPLUNK_HOME -ChildPath "bin\splunk.exe" # join-path figures out starting & trailing path separators the right way

	// Use Gists to store code you would like to remember later on
	console.log(window); // log the "window" object to the console

	# TODO: write the help
	# TODO: support SSL self-signed certs
	# TODO: need to validate JSON, and/or add a new param set that accepts hashtable and
	# convert internally.
	# TODO: support RAW mode
	# TODO: refactor to use EC batch (concatenated events in one HTTP request) instead of
	# PowerShell pipelines which will do a request per object (event payload) on the pipeline
	# TODO: think about load balancing per Geoffrey Martins.

	<![LOG[CScanAgent::ScanByUpdates - Found UpdateClassification 0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:f2b6e975-cae9-493a-a17d-ca429e6738e5]LOG]!><time="10:40:29.580+300" date="11-12-2014" component="ScanAgent" context="" type="1" thread="12052" file="cscanagent.cpp:470">
	<![LOG[Found CategoryID of :bfe5b177-a086-47a0-b102-097e4fa1f807 for Update:f61f6c4b-4598-4571-9663-9333a0906778]LOG]!><time="10:40:29.642+300" date="11-12-2014" component="ScanAgent" context="" type="1" thread="12052" file="cscanagent.cpp:453">
	<![LOG[CScanAgent::ScanByUpdates - Found UpdateClassification 0fa1201d-4330-4fa8-8ae9-b877473b6441 for Update:f61f6c4b-4598-4571-9663-9333a0906778]LOG]!><time="10:40:29.643+300" date="11-12-2014" component="ScanAgent" context="" type="1" thread="12052" file="cscanagent.cpp:470">
	<![LOG[Found CategoryID of :2ee2ad83-828c-4405-9479-544d767993fc for Update:f6bb2d17-0f0e-4a98-970b-7aaa85aae8ce]LOG]!><time="10:40:29.643+300" date="11-12-2014" component="ScanAgent" context="" type="1" thread="12052"