SplunkBase Applications

SplunkBase Applications 2010-02-08T23:58:31+00:00 http://www.splunkbase.com/api/apps/entries/?category=Business_Intelligence 11 10 1 Splunk for IMAP 2009-11-17T01:32:28+00:00 http://www.splunkbase.com/api/apps/entries/Splunk+for+IMAP erik 3518 erik erik@splunk.com 2007-08-19T04:54:12+00:00 2009-11-17T01:32:28+00:00 Free Creative Commons http://www.splunkbase.com/apps:license/Splunk+for+IMAP 1.20 Searches Scripted Inputs Inputs 5.0 3 0 http://www.splunkbase.com/apps/Splunk+for+IMAP http://www.splunkbase.com/apps:screenshot/original/Splunk+for+IMAP/icon.jpg 41 33 http://www.splunkbase.com/apps:screenshot/original/Splunk+for+IMAP/screenshot.jpg 129 88 http://www.splunkbase.com/apps:screenshot/scaled/Splunk+for+IMAP/screenshot.jpg 129 88 http://www.splunkbase.com/apps:screenshot/thumb/Splunk+for+IMAP/screenshot.jpg 107 73 3.0.0 4.999.999

This application will continually download mail from an imap account where it is indexed by a Splunk server. You can do cool things like see how often you get mail from someone, graph by size, time, etc.

RSS Scripted Input 2009-10-15T21:15:05+00:00 http://www.splunkbase.com/api/apps/entries/RSS+Scripted+Input ndoshi 209 ndoshi nimish@splunk.com 2009-08-13T23:40:34+00:00 2009-10-15T21:15:05+00:00 Free Creative Commons http://www.splunkbase.com/apps:license/RSS+Scripted+Input 1.0.2 Scripted Inputs Inputs Fields No Data 0 1 http://www.splunkbase.com/apps/RSS+Scripted+Input http://www.splunkbase.com/apps:screenshot/original/RSS+Scripted+Input/icon.jpg 36 36 0 0 0 0 0 0 3.0.0 4.999.999

This is a simple application to take the content of any RSS feed and index its metadata (date, title, link, and description) into Splunk. A scripted input calls rss.sh every 600 seconds, which in turn, calls the supplied Python program, rssfeed.py to gather the rss feeds. RSS feeds are supplied via a file passed on the command line. A sample file, feeds.txt, is provided for testing. This program uses the open source feedparser from www.feedparser.org for its RSS parser. Installation: Gunzip and un tar the distirbution into $SPLUNK_HOME/etc/apps and read the README.txt

Web Services Stock Quote as Scripted Input 2009-10-10T20:54:29+00:00 http://www.splunkbase.com/api/apps/entries/Web+Services+Stock+Quote+as+Scripted+Input ndoshi 300 ndoshi nimish@splunk.com 2008-12-09T18:06:56+00:00 2009-10-10T20:54:29+00:00 Free Creative Commons http://www.splunkbase.com/apps:license/Web+Services+Stock+Quote+as+Scripted+Input 1.1.1 Scripted Inputs Fields No Data 0 1 http://www.splunkbase.com/apps/Web+Services+Stock+Quote+as+Scripted+Input http://www.splunkbase.com/apps:screenshot/original/Web+Services+Stock+Quote+as+Scripted+Input/icon.jpg 36 36 http://www.splunkbase.com/apps:screenshot/original/Web+Services+Stock+Quote+as+Scripted+Input/screenshot.jpg 400 320 http://www.splunkbase.com/apps:screenshot/scaled/Web+Services+Stock+Quote+as+Scripted+Input/screenshot.jpg 400 320 http://www.splunkbase.com/apps:screenshot/thumb/Web+Services+Stock+Quote+as+Scripted+Input/screenshot.jpg 91 73 3.0.0 4.999.999

This distribution calls a stock quote web service with a list of stock symbols as input which is output to Splunk's indexer. The code makes use of the Apache Axis client library to call a web service as a scripted input to retrieve stock quote reports for stock symbols and use each response as an event stored in XML format. It is used as a demonstration for using web services as a scripted input. The work to call the web service for each stock symbol is \ done in the GatherStockQuote.java program. To install, use tar zxvf and place the stockquotes directory under SPLUNK_HOME/etc/apps/. Then read the README_StockQuote.txt for further configuration. You can use this to create your own time series data store for stock information and create reports. This ships with one field action to get detailed information on a symbol. (use xmlkv to extract the symbol field).

IP2Location - GeoIP Lookups 2009-02-11T15:46:36+00:00 http://www.splunkbase.com/api/apps/entries/IP2Location+-+GeoIP+Lookups rataide 1004 rataide 2009-02-09T14:22:11+00:00 2009-02-11T15:46:36+00:00 Free Creative Commons http://www.splunkbase.com/apps:license/IP2Location+-+GeoIP+Lookups 1.2 Search Commands No Data 0 1 http://www.splunkbase.com/apps/IP2Location+-+GeoIP+Lookups 0 0 0 0 0 0 0 0 3.0.0.0 3.999.999

Provide IP-to-location look up support via a free GeoIP API. Please see README for non-trivial installation instructions. Latest changes (See CHANGELOG for full details): * Enhancement: Added a switch ["-nodns"|"nodns"] to disable name resolution. Usage: ....| geoip -nodns dest_ip * Enhancement: Now only real RFC/1918 IPs will have the city populated with "RFC/1918" other IPs with no resolution revert to "Unknown"

Splunk for IIS W3C extended 2008-12-16T00:07:43+00:00 http://www.splunkbase.com/api/apps/entries/Splunk+for+IIS+W3C+extended canuck 1806 canuck 2008-12-16T00:07:43+00:00 2008-12-16T00:07:43+00:00 Free Creative Commons http://www.splunkbase.com/apps:license/Splunk+for+IIS+W3C+extended 0.1 Searches Reports Fields No Data 1 1 http://www.splunkbase.com/apps/Splunk+for+IIS+W3C+extended 0 0 0 0 0 0 0 0 3.0.0.0 3.999.999

The Splunk for IIS W3C extended application adds several saved searches which can be used for reporting and alerts. In the near future this application will also add several event types related to common IIS attacks.

Script for database inputs 2008-10-23T23:50:16+00:00 http://www.splunkbase.com/api/apps/entries/Script+for+database+inputs rcarney 3152 rcarney 2008-10-23T23:50:16+00:00 2008-10-23T23:50:16+00:00 Free Creative Commons http://www.splunkbase.com/apps:license/Script+for+database+inputs 0.1 Scripted Inputs Integration Inputs Custom Processing 3.5 4 1 http://www.splunkbase.com/apps/Script+for+database+inputs 0 0 0 0 0 0 0 0 3.0.0.0 3.999.999

This script is designed to be used as a scripted input for data contained in database tables. Plese refer to the Splunk Admin guide for more information on configuring scripted inputs. The script has been successfully used in a number of deployments, and should work with Oracle, MySQL, and sybase databases as-is. Other database types can be added by installing the appropriate perl DBD module, and editing the script to configure for the new dbtype. In this version, all of the SQL code has been abstracted from the script, and all parameters including the query are passed as commandline arguments to the script.

Information Adder 2008-10-23T16:07:24+00:00 http://www.splunkbase.com/api/apps/entries/Information+Adder rataide 247 rataide 2008-10-16T23:27:50+00:00 2008-10-23T16:07:24+00:00 Free Creative Commons http://www.splunkbase.com/apps:license/Information+Adder 1.2 Search Commands No Data 0 1 http://www.splunkbase.com/apps/Information+Adder 0 0 0 0 0 0 0 0 3.0.0.0 3.999.999

This search script will add additional information from a CSV file to your events. Changelog: v1.2 - Now includes basic error checking and additional fixes for malformed CSV files

Splunk License Usage 2008-06-23T15:55:31+00:00 http://www.splunkbase.com/api/apps/entries/Splunk+License+Usage joshs 3092 joshs 2008-06-03T22:18:58+00:00 2008-06-23T15:55:31+00:00 Free Creative Commons http://www.splunkbase.com/apps:license/Splunk+License+Usage 1.2 Searches Reports Other 5.0 8 1 http://www.splunkbase.com/apps/Splunk+License+Usage 0 0 0 0 0 0 0 0 3.0.0.0 3.999.999

This bundle provides a new dashboard which has several widgets that query to help you determine your Splunk license usage total over the past 24 hours as well as usage by host, source, and sourcetype. It contains timecharts to help you understand usage over time and see usage spikes as well as pie charts to help you to figure out which log files, sourcetypes, and hosts Splunk is indexing the most data from.

Splunk Globe 2008-04-28T09:04:09+00:00 http://www.splunkbase.com/api/apps/entries/Splunk+Globe kordless 1988 kordless 2008-04-28T09:04:08+00:00 2008-04-28T09:04:09+00:00 Free Creative Commons http://www.splunkbase.com/apps:license/Splunk+Globe 1.0 Reports Clients No Data 0 1 http://www.splunkbase.com/apps/Splunk+Globe 0 0 0 0 0 0 0 0 3.0.0.0 3.999.999

Splunk Globe uses the Poly9 FreeEarth plugin. Splunk Globe queries a Splunk instance for the most recent IP addresses, then plots them on the globe. Updates occur in near real-time.