Latest SplunkBase Applications (Operations)

Splunk for Change Management

Splunk — Mon, 01 Dec 2008 18:36:09 +0000

Splunk for Change Management provides predefined reports and dashboards to facilitate change auditing, change detection, change reporting, change validation and incident response based on change events, change tickets and configuration files.

Splunk Enterprise Manager

76trombones — Mon, 24 Nov 2008 19:00:55 +0000

A Splunk application that provides visibility into the connectivity of Splunk forwarders to one or more indexers, the availability of Splunk forwarders and indexers, the data volumes passed by forwarders and the data volumes consumed by indexers. Displayed within a dashboard view.

Script for database inputs

rcarney — Thu, 23 Oct 2008 23:50:16 +0000

This script is designed to be used as a scripted input for data contained in database tables. Plese refer to the Splunk Admin guide for more information on configuring scripted inputs. The script has been successfully used in a number of deployments, and should work with Oracle, MySQL, and sybase databases as-is. Other database types can be added by installing the appropriate perl DBD module, and editing the script to configure for the new dbtype. In this version, all of the SQL code has been abstracted from the script, and all parameters including the query are passed as commandline arguments to the script.

Splunk for Citrix XenServer Management

Splunk — Thu, 16 Oct 2008 19:10:09 +0000

This Splunk application manages Citrix XenServers. It includes inputs, indexing, searches, reports, dashboards and field actions.

Splunk for tcpdump

rataide — Tue, 16 Sep 2008 19:43:30 +0000

This application will allow you to collect data from a tcpdump standard output directly into Splunk, it will also perform the necessary field extractions based on the Common Information Model This application is compliant with the 3.3.x standard.

Splunk for Network

Splunk — Fri, 05 Sep 2008 23:29:25 +0000

This is a simple application to monitor change on network device configurations. It runs a scripted input to request the network device upload it's configuration file to a tftp server. The input reads /tftpboot for any files that get uploaded and indexes them through the fschange source.

Splunk for Jira

Splunk — Fri, 05 Sep 2008 23:27:48 +0000

This application reads in issues for a Jira server. It uses a scripted input that accesses the Jira remote SOAP interface.

Tranaction eventbreaker

kbains — Thu, 28 Aug 2008 21:13:56 +0000

When doing a CLI search for transactions, it can be hard to know the start and end points of the events. This script adds line breaks (with timestamps) between the events.

Web Page Monitor

erik — Fri, 15 Aug 2008 03:17:24 +0000

This bundle will check a set of webpages every interval and index the result, time, size and optionally content and or crc of page(s). Its cool to do searches to see when your pages change, take long to load, or many other cool things.

Splunk Alert

yantisj — Fri, 04 Apr 2008 14:41:38 +0000

Command line utility to more easily search the splunk database, log specific errors and execute commands on a match. Comes with several predefined searches for cisco networking, and is easily extended. -s search Predefined search to run, use 'list' for options -cs string Custom search string passed in with quotes -l file Log results to file, appends by default -e email_addr Email addresses comma separated -x command Execute a command on a match -t time_restrict Suppress email alerts by time of day, use 'list' for options -d days Search over this many days in the past (default: 1) -m minutes Search over this many minutes in the past -c maxnum Max number of results (default: 100) -r Reverse results, (newest to oldest) -w Raw results, do not strip off timestamps -q Quiet Output, suppress errors -v Verbose output

twiki logs

nick — Wed, 05 Mar 2008 21:37:27 +0000

Contains the basic extractions as well as some saved searches, reports, event types, and custom dashboard modules.

Alex's sendemail.py

araitz — Fri, 16 Nov 2007 21:52:33 +0000

A modified version of sendemail.py which allows you to configure which fields are displayed in alert emails.

Perfgraph

rdas — Fri, 12 Oct 2007 01:05:09 +0000

A Splunk performance visualization search processor. See my blog for more information.

Arkeia

maverick — Fri, 07 Sep 2007 04:16:47 +0000

Arkeia Network Backup Bundle used to index the common fields from the backup log file to make searching and reporting easier.

IPMI Fan Speeds

markc — Mon, 13 Aug 2007 19:12:01 +0000

Gather and report on system fan speeds using ipmi

SMART Disk Reporting

markc — Mon, 20 Aug 2007 07:52:30 +0000

This bundle outputs this text : === START OF INFORMATION SECTION === Model Family= Seagate Momentus 7200.1 series Device Model= ST910021AS Serial Number= 3MH0498W Firmware Version= 3.07 User Capacity= 100,030,242,816 bytes Device is= In smartctl database [for details use: -P show] ATA Version is= 7 ATA Standard is= Exact ATA specification draft version not indicated Local Time is= Mon Aug 20 00:38:18 2007 PDT SMART support is= Available - device has SMART capability. SMART support is= Enabled === START OF READ SMART DATA SECTION === SMART overall-health self-assessment test result= PASSED Which is then indexed by Splunk.

steveyz_bundle

steveyz — Fri, 17 Aug 2007 22:36:50 +0000

A few useful searches leveraging the monitoring bundle data, using the multikv operator