Skip to content

Instantly share code, notes, and snippets.

View halr9000's full-sized avatar
👋
🤙

Hal Rottenberg halr9000

👋
🤙
View GitHub Profile
@halr9000
halr9000 / test.ps1
Last active August 29, 2015 14:21
Simple PowerShell scripted input for Splunk that can invoke Splunk commands
# Get script path (works on v2+ of PowerShell) http://stackoverflow.com/a/5466355. v3+ has $PSScriptRoot variable, but win2k3 boxes might not have v3.
$scriptPath = split-path -parent $MyInvocation.MyCommand.Definition
Write-Verbose "Script Path: $scriptPath"
# find $SPLUNK_HOME starting from the bin path for an app, e.g. $env:programfiles\Splunk\etc\apps\appname\bin\test.ps1
# could just use string concatenation, but using the Resolve-Path and Join-Path cmdlets here will generate useful errors if they fail
$SPLUNK_HOME = Resolve-Path ( Join-Path -Path $scriptPath -ChildPath "..\..\..\.." ) # if my relative path is right?
Write-Verbose "Splunk Home: $splunk_home"
$SPLUNK_BIN = Join-Path -Path $SPLUNK_HOME -ChildPath "bin\splunk.exe" # join-path figures out starting & trailing path separators the right way
@halr9000
halr9000 / 0_reuse_code.js
Last active August 29, 2015 14:20
Here are some things you can do with Gists in GistBox.
// Use Gists to store code you would like to remember later on
console.log(window); // log the "window" object to the console
@halr9000
halr9000 / SplunkStream.psm1
Last active August 29, 2015 14:18
Splunk Stream helper module
<#
.Synopsis
Returns XML object for local stream forwarder configuration if it exists, or optionally, default configuration.
.DESCRIPTION
Long description
.EXAMPLE
Get-StreamForwarderConfigXml -DefaultConfig
xml CmConfig
--- --------
@halr9000
halr9000 / boxstarter.txt
Last active August 29, 2015 14:15
boxstarter
Install-WindowsUpdate
Enable-RemoteDesktop
cinst git-credential-winstore
cinst console-devel
cinst sublimetext3
cinst poshgit
cinst google-chrome-x64
cinst AWSTools.Powershell
@halr9000
halr9000 / Dockerfile
Created January 20, 2015 14:41
docker run splunk
FROM centos:latest
MAINTAINER splunk@splunk.com
EXPOSE 8000 8089 9997 9887 8191
ADD splunk/ /opt/splunk/
VOLUME ["/opt/splunk/var/lib"]
CMD ["/opt/splunk/bin/splunk", "start", "--nodaemon", "--accept-license", "--no-prompt", "--answer-yes", "--auto-ports"]
@halr9000
halr9000 / gist:20ab184a91277f3a2438
Created November 14, 2014 02:46
xExchange DSC Resources
xExchActiveSyncVirtualDirectory xExchAutodiscoverVirtualDirectory
xExchAutoMountPoint xExchClientAccessServer
xExchDatabaseAvailabilityGroup xExchDatabaseAvailabilityGroupMember
xExchDatabaseAvailabilityGroupNetwork xExchEcpVirtualDirectory
xExchExchangeCertificate xExchExchangeServer
xExchImapSettings xExchMailboxDatabase
xExchMailboxDatabaseCopy xExchMapiVirtualDirectory
xExchOabVirtualDirectory xExchOutlookAnywhere
xExchOwaVirtualDirectory xExchPopSettings
xExchPowerShellVirtualDirectory xExchReceiveConnector
@halr9000
halr9000 / splunkutils.ps1
Created June 27, 2014 14:54
PowerShell function to start Splunk
Function Start-Splunk {
try {
Get-Service splunk* | Start-Service -ErrorAction Stop
}
catch [Microsoft.PowerShell.Commands.ServiceCommandException] {
Write-Verbose "Command must be run in an elevated session, invoking new session."
Start-Process -Verb Runas -FilePath powershell.exe { Get-Service splunk* | Start-Service -Verbose -ErrorAction Stop; Start-Sleep 5 }
}
}
@halr9000
halr9000 / CiscoUcs.py
Created June 19, 2014 13:46
Splunk Python scripts to collect data from Cisco UCS
import warnings
__author__ = 'JBennett'
# A class wrapper for calls to Cisco UCS Managers
#! /Library/Frameworks/Python.framework/Versions/2.7/bin/python
########################################
## Library functions
########################################
from datetime import datetime
import sys, time, os, csv
import httplib, urllib, hashlib, base64, hmac, urlparse, md5
import xml.dom.minidom, xml.sax.saxutils
import logging
import tarfile, gzip
ENDPOINT_HOST_PORT = "s3.amazonaws.com"
# set up logging suitable for splunkd consumption
logging.root
@halr9000
halr9000 / Export-SplunkSearch.ps1
Created September 18, 2013 04:27
Splunk export search job using PowerShell
# Conversion of http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#search.2Fjobs.2Fexport
# example using curl, to PowerShell with Invoke-RestMethod cmdlet
#
# $ curl -k -u admin:changeme https://localhost:8089/services/search/jobs/export
# --data-urlencode search="search index=_internal | stats count by sourcetype"
# -d output_mode=json -d earliest="rt-5m" -d latest="rt"
$cred = Get-Credential
# This will allow for self-signed SSL certs to work