Useful for checking the kvstore status across a series of Splunk Enterprise hosts. Used for testing at scale for events and workshops.

check_kv_store.py

from urllib.request import HTTPBasicAuthHandler
import requests,json, csv
from requests.auth import HTTPBasicAuth
from argparse import ArgumentParser

parser = ArgumentParser(description="Checks the status of the KVStore for targeted systems for use with workshops & demos.")
parser.add_argument(
    "-i",
    "--input",
    default=None,
    help="Provide path to CSV. Should be formatted with the server URL in the first column."
)
parser.add_argument(
    "-a",
    "--url",
    default=None,
    help="URL to check: https://hostname"
)
parser.add_argument(
    "-u",
    "--username",
    default="admin",
    help="Username to authenticate with, defaults to admin"
)
parser.add_argument(
    "-p",
    "--password",
    default=None,
    required=True,
    help="Password to authenticate with"
)
parser.add_argument(
    "-po",
    "--port",
    default=8089,
    help="Splunk Management Port, defaults to 8089"
)
parser.add_argument(
    "-v",
    "--verbose",    
    action='store_true',
    help="Enabled output of all status messages instead of just 'failed' servers."
)
args = parser.parse_args()

if args.input or args.url:
    requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
    hostsToCheck = []
    if args.input:
        with open(args.input) as csv_file:
            csv_reader = csv.reader(csv_file, delimiter=',')
            lineCount = 0
            for row in csv_reader:
                if lineCount == 0:
                    lineCount += 1
                    continue
                else:
                    hostsToCheck.append(row[0])
                    lineCount += 1
    else:
        hostsToCheck.append(args.url)

    params = {'output_mode': "json"}
    for server in hostsToCheck:
        try:
            response = requests.get(f"{server}:{args.port}/services/kvstore/status",verify=False, auth=HTTPBasicAuth(args.username,args.password),params=params)
            if response.status_code == 200:
                timestamp = response.headers["date"]
                kvStoreStatus = response.json()['entry'][0]["content"]["current"]["status"]
                if kvStoreStatus == "failed" or args.verbose == True:
                    print(f"{timestamp}: KVStore Status {kvStoreStatus} on {server}")
            else:
                print(f"Error connecting to {server}, returned HTTP code {response.status_code}")
        except:
            print(f"Error connecting to {server}. Moving on to next server(s) if any.")
else:
    print("No csv or URL provided.")