Skip to content

Instantly share code, notes, and snippets.

View hobbes3's full-sized avatar
😅

Satoshi Kawasaki hobbes3

😅
27 followers · 4 following
  • Splunk
View GitHub Profile
@hobbes3
hobbes3 / props.conf
Last active October 10, 2023 10:41
Example Splunk props + transforms
# 2014-05-11 12:34:11,372 INFO amec.foobar.com 148.23.14.242 | action = accept | status = 200 | bytes = 235 | method = GET | request = /store/checkout?q=foo&var=123#test | custom_var = some string with a "|" in it | another_var = !@#$1234
[my_sourcetype]
# index-time settings:
# http://regex101.com/r/fX9lB1
LINE_BREAKER = ([\r\n]+)\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3} [A-Z]+
TRUNCATE = 1000
SHOULD_LINEMERGE = false
# http://regex101.com/r/lK9xB8
TIME_PREFIX = ^
@hobbes3
hobbes3 / ubuntu_install_bash.sh
Last active January 31, 2020 02:15
ubnutu install splunk config
# Must run as root
NAME="my_server"
SSH_PORT=9922
hostnamectl set-hostname $NAME
# SSH
echo -e "\nPort $SSH_PORT" >> /etc/ssh/sshd_config
service ssh restart
@hobbes3
hobbes3 / kml_get_centroid.py
Last active September 10, 2019 23:35
KML get centroid
#!/usr/bin/env python
# hobbes3
import xml.etree.ElementTree as ET
import csv
from statistics import mean
KML_FILE = "sf_blocks.kml"
CSV_FILE = "sf_blocks_lat_lon.csv"
CSV_COLUMNS = ["BLKLOT", "lat", "lon"]
@hobbes3
hobbes3 / multiselect_force_default.js
Last active August 1, 2019 01:29
multiselect force default select input
// TESTED in 7.3.x and 6.5.x (so should work in all other versions)
require([
'jquery',
'underscore',
'splunkjs/mvc',
'splunkjs/mvc/simplexml/ready!'
], function(
$,
_,
@hobbes3
hobbes3 / install_stuff_on_amazon_linux_2.sh
Last active July 11, 2019 07:19
amazon linux 2 python pyenv node nodejs install yum
# Running as root
### PYENV
yum install -y git gcc gcc-c++ make git patch openssl-devel zlib-devel readline-devel sqlite-devel bzip2-devel zlib libffi-devel
# Switch to the user that will use pyenv
git clone https://github.com/pyenv/pyenv.git ~/.pyenv
echo 'export PYENV_ROOT="$HOME/.pyenv"' >> ~/.bash_profile
echo 'export PATH="$PYENV_ROOT/bin:$PATH"' >> ~/.bash_profile
echo -e 'if command -v pyenv 1>/dev/null 2>&1; then\n eval "$(pyenv init -)"\nfi' >> ~/.bash_profile
. ~/.bash_profile
@hobbes3
hobbes3 / dark.css
Last active June 4, 2019 05:57
dark theme css
/*
* Updated ONLY for 6.3 (not tested on other Splunk versions)
* Known issue: Color ranges for Marker Gauge is all black because I can't distinguish between the different <rect> in the SVG
* - hobbes3
*/
/* BACKGROUND */
body,
.dashboard-body,
.footer,
@hobbes3
hobbes3 / reset_dashboard.xml
Last active April 20, 2019 02:03
splunk dashboard reset button xml simplexml
<!-- Provided by Gleb Esman -->
<html>
<div>
<a type="button" style="margin-bottom: 10px;" class="btn" href="/app/$env:app$/$env:page$">Reset dashboard</a>
</div>
</html>
@hobbes3
hobbes3 / add_irs_990_old.py
Last active April 18, 2019 22:44
irs 990 add oneshot onboard multithread multithreading concurrent splunk4good nom on
#!/usr/bin/env python
# hobbes3
# A way to handle indexing 2+ million XML files in a single directory (synced from a S3 bucket)
import glob
import time
import logging
import logging.handlers
import subprocess
@hobbes3
hobbes3 / splunk.conf
Last active February 5, 2019 20:53
syslog-ng syslog conf splunk
@version: 3.5.6
# Typically placed as /etc/syslog-ng/conf.d/splunk.conf
options {
create-dirs(yes);
owner("splunk");
group("splunk");
dir-owner("splunk");
@hobbes3
hobbes3 / git_mass_pull.sh
Created January 16, 2019 07:03
git pull cluster master mass find
find /opt/splunk/etc/master-apps/ -name ".git" -exec dirname {} \; | xargs -I {} sh -c "echo {}; git -C {} pull;"