a very quick splunk starter example for sensu

gistfile1.txt

require 'rubygems' if RUBY_VERSION < '1.9.0'
require "net/https"
require 'json'
require 'sensu-plugin/check/cli'

class checkSplunk < Sensu::Plugin::Check::CLI

  def api_request(opts={})
    o = {
      :host => '',
      :port => '443',
      :path => '',
      :auth => false,
      :headers => false
    }.merge(opts)
  
    http = Net::HTTP.new(o[:host], o[:port])
    if o[:ssl]
      http.use_ssl = true
      http.verify_mode = OpenSSL::SSL::VERIFY_NONE
    end
    req =  Net::HTTP::Get.new(o[:path])
    if o[:auth] then req.basic_auth(o[:auth][:user], o[:auth][:pass]) end
    if o[:headers]
      o[:headers].each do |k,v|
        req[k] = v
      end
    end
    http.request(req)
  end
  
  def check_splunk
    opts = {
      :ssl => true,
      :host => "",
      :port => 8089,
      :path => "/services/alerts/fired_alerts?output_mode=json",
      :auth => { :user => "", :pass => "" }
    }
    res = JSON.parse(api_request(opts).body)
  end
  def run
    splunk = check_splunk
    if splunk["entry"][0]["content"]["triggered_alert_count"] > 0
      {do something here}
    end
  end
end