Skip to content

Instantly share code, notes, and snippets.

@jc1518 jc1518/splunk_query.js
Last active Dec 6, 2018

Embed
What would you like to do?
Nodejs splunk query sample
'use strict';
var splunkjs = require('splunk-sdk');
module.exports = function (robot) {
var service = new splunkjs.Service({
username: process.env.SPLUNK_USERNAME,
password: process.env.SPLUNK_PASSWORD,
scheme:"https",
host: process.env.SPLUNK_HOST,
port: process.env.SPLUNK_PORT
});
function splunk_login (msg) {
service.login(function(err, success) {
if (err) {
console.log(err);
msg.send("`Oops, something went wrong!`");
}
console.log("Login was successful: " + success);
return success
});
}
// Search query
var confluenceStuck = 'your search query here | parse here';
var confluenceResponseTime = 'your search query here | parse here | stats avg(response_time)';
// Set the search parameters
var searchParams = {
exec_mode: "normal",
earliest_time: "-5m"
};
// Run search
function splunk_search (searchQuery, msg) {
service.search(searchQuery, searchParams, function(err, job) {
// Display the job's search ID
console.log("Job SID: ", job.sid);
// Poll the status of the search job
job.track({period: 200}, {
done: function(job) {
console.log("Done!");
// Get the results and print them
job.results({}, function(err, results, job) {
//console.log(job.state());
//console.log(results);
var fields = results.fields;
if (fields.length == 0) {
msg.send("```Nothing```");
};
var rows = results.rows;
//console.log(rows);
for(var i = 0; i < rows.length; i++) {
var values = rows[i];
console.log("Row " + i + ": " + values);
for(var j = 0; j < values.length; j++) {
var field = fields[j];
var value = values[j];
console.log("field " + j + ": " + field)
if (field === '_raw') {
console.log(value.split('\n')[0]);
msg.send("```" + value.split('\n')[0] + "```");
}
if (field === 'avg(response_time)') {
console.log(value);
msg.send("```" + value + "```");
}
}
}
});
},
failed: function(job) {
console.log("Job failed")
msg.send("`Search job failed!`");
},
error: function(err) {
done(err);
msg.send("`Oops, something went wrong!`")
}
});
});
};
robot.respond(/confluence (stuck-thread|stuck threads)/i, function (msg) {
msg.send("What are the stuck threads in Confluence?");
if (splunk_login) {
splunk_search(confluenceStuck, msg);
}
else {
msg.send("`Login failed!`");
}
});
robot.respond(/confluence (response time|response-time)/i, function (msg) {
msg.send("What is Confluence average response time in the past 5 minutes?");
if (splunk_login) {
splunk_search(confluenceResponseTime, msg);
}
else {
msg.send("`Login failed!`");
}
});
robot.hear(/Confluence stuck thread is detected/ig, function (msg) {
msg.send("What are the stuck threads in Confluence?");
if (splunk_login) {
splunk_search(confluenceStuck, msg);
}
else {
msg.send("`Login failed!`");
}
});
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.