Skip to content

Instantly share code, notes, and snippets.

View marcusschiesser's full-sized avatar

Marcus Schiesser marcusschiesser

View GitHub Profile
@marcusschiesser
marcusschiesser / 2023_10_Extract_Table_from_PDF.ipynb
Created October 8, 2023 08:28
Extract data in tables from a PDF
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
@marcusschiesser
marcusschiesser / json.py
Created March 16, 2023 09:15
JSON handlers for Splunk Custom REST endpoints
import logging
import traceback
import json
from typing import Callable
def json_handler(func: Callable):
def wrapper(*args, **kwargs):
decorated = json_exception_handler(json_payload_extractor(func))
@marcusschiesser
marcusschiesser / iterables.py
Created March 16, 2023 09:07
Returns all items of an iterable with the same maximum or minimum value
def find_minimums(iterable, func):
"""Returns all items of the iterable with the same minimum value"""
minimum = None
minimums = []
for item in iterable:
if minimum is None or func(item) < minimum:
minimum = func(item)
minimums = [item]
elif func(item) == minimum:
minimums.append(item)
@marcusschiesser
marcusschiesser / macros.conf
Created November 18, 2022 03:35
Splunk outputlookup macro that ensure that only x% of a KV store are changed at once
[outputlookup_guard(2)]
args = name,allowed_changes
definition = eventstats count as new_count\
| eval old_count=[| inputlookup $name$ | stats count | return $count]\
| eval max_count=old_count*(1+$allowed_changes$), min_count=old_count/(1+$allowed_changes$)\
| where new_count>min_count and new_count<max_count\
| fields - new_count, old_count, min_count, max_count\
| outputlookup $name$ override_if_empty=false
iseval = 0
errormsg = 'name' must be a lookup and 'allowed_changes' must be a number between 0 and 1
@marcusschiesser
marcusschiesser / copy_secret.sh
Last active November 23, 2022 06:08
Copy a K8S secret to another namespace. If the secret exists, it is updated.
#!/usr/bin/env bash
# Depedency: requires yq>=4.x and kubectl
if [ "$#" -ne 4 ]; then
echo "Usage: copy_secret <src_namespace> <src_secret_name> <dest_namespace> <dest_secret_name>"
exit 1
fi
function copy_secret {
local src_ns=$1
@marcusschiesser
marcusschiesser / splunk-configurator.yaml
Created October 27, 2022 03:52
Splunk deployment to configure another splunk instance started by the Splunk operator (Example: add user)
apiVersion: apps/v1
kind: Deployment
metadata:
name: splunk-configurator
spec:
selector:
matchLabels:
app.kubernetes.io/name: splunk-configurator
replicas: 1
template:
@marcusschiesser
marcusschiesser / splunk.yaml
Last active April 21, 2022 07:22
Liveness and Readiness Checks for Splunk in K8S
apiVersion: apps/v1
kind: Deployment
metadata:
name: splunk
spec:
selector:
matchLabels:
app.kubernetes.io/name: splunk
replicas: 1
template:
@marcusschiesser
marcusschiesser / upper-body.md
Created April 13, 2022 13:53
Fitmark exercises

‎‎​

@marcusschiesser
marcusschiesser / commands.conf
Created March 27, 2022 03:36
Splunk command that runs a search for each event by passing the event's values as parameters
[mapsearch]
chunked = true
filename = map_search.py
python.version = python3
@marcusschiesser
marcusschiesser / index.html
Last active February 25, 2022 03:53
Custom Login Page in Splunk
<!DOCTYPE html>
<html>
<head>
</head>
<body>
<form method="post" id="loginForm">
<div>
<input type="text" name="username" placeholder="Username" />