Skip to content

Instantly share code, notes, and snippets.

@jc1518 jc1518/splunk_query.js
Last active Dec 6, 2018

Embed
What would you like to do?
Nodejs splunk query sample
'use strict';
var splunkjs = require('splunk-sdk');
module.exports = function (robot) {
var service = new splunkjs.Service({
username: process.env.SPLUNK_USERNAME,
password: process.env.SPLUNK_PASSWORD,
scheme:"https",
host: process.env.SPLUNK_HOST,
port: process.env.SPLUNK_PORT
});
function splunk_login (msg) {
service.login(function(err, success) {
if (err) {
console.log(err);
msg.send("`Oops, something went wrong!`");
}
console.log("Login was successful: " + success);
return success
});
}
// Search query
var confluenceStuck = 'your search query here | parse here';
var confluenceResponseTime = 'your search query here | parse here | stats avg(response_time)';
// Set the search parameters
var searchParams = {
exec_mode: "normal",
earliest_time: "-5m"
};
// Run search
function splunk_search (searchQuery, msg) {
service.search(searchQuery, searchParams, function(err, job) {
// Display the job's search ID
console.log("Job SID: ", job.sid);
// Poll the status of the search job
job.track({period: 200}, {
done: function(job) {
console.log("Done!");
// Get the results and print them
job.results({}, function(err, results, job) {
//console.log(job.state());
//console.log(results);
var fields = results.fields;
if (fields.length == 0) {
msg.send("```Nothing```");
};
var rows = results.rows;
//console.log(rows);
for(var i = 0; i < rows.length; i++) {
var values = rows[i];
console.log("Row " + i + ": " + values);
for(var j = 0; j < values.length; j++) {
var field = fields[j];
var value = values[j];
console.log("field " + j + ": " + field)
if (field === '_raw') {
console.log(value.split('\n')[0]);
msg.send("```" + value.split('\n')[0] + "```");
}
if (field === 'avg(response_time)') {
console.log(value);
msg.send("```" + value + "```");
}
}
}
});
},
failed: function(job) {
console.log("Job failed")
msg.send("`Search job failed!`");
},
error: function(err) {
done(err);
msg.send("`Oops, something went wrong!`")
}
});
});
};
robot.respond(/confluence (stuck-thread|stuck threads)/i, function (msg) {
msg.send("What are the stuck threads in Confluence?");
if (splunk_login) {
splunk_search(confluenceStuck, msg);
}
else {
msg.send("`Login failed!`");
}
});
robot.respond(/confluence (response time|response-time)/i, function (msg) {
msg.send("What is Confluence average response time in the past 5 minutes?");
if (splunk_login) {
splunk_search(confluenceResponseTime, msg);
}
else {
msg.send("`Login failed!`");
}
});
robot.hear(/Confluence stuck thread is detected/ig, function (msg) {
msg.send("What are the stuck threads in Confluence?");
if (splunk_login) {
splunk_search(confluenceStuck, msg);
}
else {
msg.send("`Login failed!`");
}
});
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.