splunk
traceroute command
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
This add on is a traceroute Splunk command that takes an address field (ip
or hostname) in your events and traces the route to the address from the
Splunk indexer. It uses a default of 2 second timeouts per hop, 20 hops max,
and stops searching after it finds 5 non-responsive addresses per IP query. All
of this is configurable in the Python command. Credit goes to Leonid Grinberg
for providing a sample to build the code from
https://github.com/leonidg/Poor-Man-s-traceroute. Results go to a new field
called traceroute in the [num] address [num] address ... format.
Note: the command requires root (sudo) or Administrator access to run. If you
start Splunk as a root user, you must continue to use it as root as root now
owns the Splunk index files. Do not go back and forth from root to the
normal user. See the README.txt for installation.
Usage:
| traceroute
or hostname) in your events and traces the route to the address from the
Splunk indexer. It uses a default of 2 second timeouts per hop, 20 hops max,
and stops searching after it finds 5 non-responsive addresses per IP query. All
of this is configurable in the Python command. Credit goes to Leonid Grinberg
for providing a sample to build the code from
https://github.com/leonidg/Poor-Man-s-traceroute. Results go to a new field
called traceroute in the [num] address [num] address ... format.
Note: the command requires root (sudo) or Administrator access to run. If you
start Splunk as a root user, you must continue to use it as root as root now
owns the Splunk index files. Do not go back and forth from root to the
normal user. See the README.txt for installation.
Usage:
| traceroute
Release Notes
Version 1.0.1
April 16, 2014
Cleaned up install and added <address as <local-field> > parameter to rename field passed to command.
Version 1.0
July 6, 2011