You need to create a forwarderquery.conf in /local with this structure as minimum:
[default]
user=admin
password=yourfunnypassword
port=8089
Also you need to have set a password on the forwarders or configured them to accept login even though the admin password was never change etc.
For a breakdown of what changes see the changelog below.
Feel free to reach me at curious.sle@gmail.com
Version: 0.1
Version 0.1, works so far... Simple command to query the forwarder on its rest service port 8089 Please copy the forwarderquery.conf from default to local and modify to your needs. Samples: ################## # TA-forwarderquery ################## [forwarderquery-command] syntax = |forwarderquery server="xyz" api="/services/..." stanza="default" description = this command will contact the forwarder rest port and get the xml presented in a field xmlresults usage = public example1 = |forwarderquery server="xyz" api="/services/data/outputs/tcp/server" stanza="default"| spath input=xmlresults| fields - xmlresults| fields feed.entry.title | rename feed.entry.title AS indexershortdesc = query the nimbus webservice interface comment1 = get the forwarder example2 = |forwarderquery server="xyz" api="/servicesNS/nobody" stanza="default" | spath input=xmlresults | rename feed.entry.title AS title | table title | mvexpand title | rename title AS app comment2 = get the installed apps example3 = |forwarderquery server="xyz" api="/servicesNS/nobody/search/data/inputs/monitor/" | spath input=xmlresults | rename feed.entry.id AS id | rename feed.entry.title AS title | rename feed.entry.updated AS updated | eval tmp=mvzip(title,id) | table tmp | mvexpand tmp | eval tmp=split(tmp,",")| eval file=mvindex(tmp,0) | eval id=mvindex(tmp,1) | search id="search" | table file comment3 = get the locally added monitored files related = tags =
New in Version 0.2:
port is now taken from the forwarderquery.conf, alternatively user port="xyz" to override
new parameter method, defaults to GET, can set it to method="POST" in order to perform stuff like a restart
updated dashboard now shows the deploy-poll server(s)
pending: the xml output should be passed in _raw not xmlresults for ease of use.
New in Version 0.3:
Add a file via oneshot
New in Version 0.4:
contains a new command to perform rest calls on a list of hosts. Also allows to post data and can also call a DELETE action for eliminating endpoint configs. New UI for checking the connection to forwarders via REST, check the deploy-poll settings and - whee! - a browser for the remote filesystem.
New features in v0.5:
Forwarder host resource inspector dashboard
Overview of forwarder resources
New features in v.06:
remote rest explorer
remote filesystem explorer - depends on https://splunkbase.splunk.com/app/3118/ for vis
New features in v0.7:
TailingProcessor FileStatus dashboard (under tools)
(!) Note: this needs the forwarder introspection to be enabled as described in https://answers.splunk.com/answers/191486/how-to-collect-introspection-logs-from-forwarders.html
New dashboard "TailingProcessor FileStatus"
Version 0.6 - now has improved remote rest and remote filesystem explorer. Dependency is https://splunkbase.splunk.com/app/3118/ for the remote filesystem explorer though.
Work in progress, new outpumode json2 - fairly full parsed output. For backwards compatibility this is not default and json will de deprecated.
New features in v0.5:
Forwarder host resource inspector dashboard
Overview of forwarder resources
Note: this needs the forwarder introspection to be enabled as described in https://answers.splunk.com/answers/191486/how-to-collect-introspection-logs-from-forwarders.html
Version 0.4 contains a new command to perform rest calls on a list of hosts. Also allows to post data and can also call a DELETE action for eliminating endpoint configs.
New UI for checking the connection to forwarders via REST, check the deploy-poll settings and - whee! - a browser for the remote filesystem.
New: pass post parameters like this
data="{¨property':'one','secondproperty':'two'}"
example:
|forwarderquery server="myhost" api="/services/data/inputs/oneshot" stanza="default" method="POST" data="{'name':'/full/path/file.name,'index':'main','sourcetype':'funkysourcetype'}"
Version 0.2
Whats new:
port is now taken from the forwarderquery.conf, alternatively user port="xyz" to override
new parameter method, defaults to GET, can set it to method="POST" in order to perform stuff like a restart
* updated dashboard now shows the deploy-poll server(s)
pending: the xml output should be passed in _raw not xmlresults for ease of use.
Version 0.1, works so far...
Simple command to query the forwarder on its rest service port 8089
Please copy the forwarderquery.conf from default to local and modify to your needs.
Samples:
[forwarderquery-command]
syntax = |forwarderquery server="xyz" api="/services/..." stanza="default"
description = this command will contact the forwarder rest port and get the xml presented in a field xmlresults
usage = public
example1 = |forwarderquery server="xyz" api="/services/data/outputs/tcp/server" stanza="default"| spath input=xmlresults| fields - xmlresults| fields feed.entry.title | rename feed.entry.title AS indexershortdesc = query the nimbus webservice interface
comment1 = get the forwarder
example2 = |forwarderquery server="xyz" api="/servicesNS/nobody" stanza="default" | spath input=xmlresults | rename feed.entry.title AS title | table title | mvexpand title | rename title AS app
comment2 = get the installed apps
example3 = |forwarderquery server="xyz" api="/servicesNS/nobody/search/data/inputs/monitor/" | spath input=xmlresults | rename feed.entry.id AS id | rename feed.entry.title AS title | rename feed.entry.updated AS updated | eval tmp=mvzip(title,id) | table tmp | mvexpand tmp | eval tmp=split(tmp,",")| eval file=mvindex(tmp,0) | eval id=mvindex(tmp,1) | search id="search" | table file
comment3 = get the locally added monitored files
related =
tags =
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.