Skip to content

Commit 2f5296e

Browse files
jay-johnsonjay-johnson
committed
renamed to sp and added a compose file for running on a vm using a bridged adapter
1 parent d07cbae commit 2f5296e

File tree

6 files changed

+141
-34
lines changed

6 files changed

+141
-34
lines changed

‎README.rst

+21-15
Original file line numberDiff line numberDiff line change
@@ -81,22 +81,22 @@ Please wait a few while the container is getting ready. You may see output like
8181
Get Splunk Logs from the Command Line Tool
8282
------------------------------------------
8383

84-
Use the command line tool: **spy** to search for recent logs.
84+
Use the command line tool: **sp** to search for recent logs.
8585

8686
::
8787

88-
spy
88+
sp
8989

9090
Which will log something like:
9191

9292
::
9393

94-
spy - INFO - creating client user=trex address=localhost:8089 login=localhost:8089
95-
spy - INFO - connecting trex@localhost:8089
96-
spy - INFO - No matches for search={
94+
sp - INFO - creating client user=trex address=localhost:8089 login=localhost:8089
95+
sp - INFO - connecting trex@localhost:8089
96+
sp - INFO - No matches for search={
9797
"search": "search index=\"antinex\" | head 10"
9898
}
99-
spy - INFO - done
99+
sp - INFO - done
100100

101101
Write Splunk Logs
102102
-----------------
@@ -115,13 +115,13 @@ By default the container creates an **antinex** index with a user token for the
115115
Get the Test Splunk Logs using the Command Line Tool
116116
----------------------------------------------------
117117

118-
The command line tool called ``spy`` is included with the pip on install. When you run it, it will return the most recent logs from the index (``antinex`` by default) and print them to stdout.
118+
The command line tool called ``sp`` is included with the pip on install. When you run it, it will return the most recent logs from the index (``antinex`` by default) and print them to stdout.
119119

120120
::
121121

122-
spy - INFO - creating client user=trex address=localhost:8089 login=localhost:8089
123-
spy - INFO - connecting trex@localhost:8089
124-
spy - ERROR - {
122+
sp - INFO - creating client user=trex address=localhost:8089 login=localhost:8089
123+
sp - INFO - connecting trex@localhost:8089
124+
sp - ERROR - {
125125
"asctime": "2018-06-21 16:53:25,509",
126126
"custom_key": "custom value",
127127
"exc": null,
@@ -135,7 +135,7 @@ The command line tool called ``spy`` is included with the pip on install. When y
135135
"tags": [],
136136
"timestamp": 1529625205.5090911
137137
}
138-
spy - CRITICAL - {
138+
sp - CRITICAL - {
139139
"asctime": "2018-06-21 16:53:25,508",
140140
"custom_key": "custom value",
141141
"exc": null,
@@ -149,7 +149,7 @@ The command line tool called ``spy`` is included with the pip on install. When y
149149
"tags": [],
150150
"timestamp": 1529625205.5082061
151151
}
152-
spy - ERROR - {
152+
sp - ERROR - {
153153
"asctime": "2018-06-21 16:53:25,507",
154154
"custom_key": "custom value",
155155
"exc": null,
@@ -163,7 +163,7 @@ The command line tool called ``spy`` is included with the pip on install. When y
163163
"tags": [],
164164
"timestamp": 1529625205.5078382
165165
}
166-
spy - INFO - {
166+
sp - INFO - {
167167
"asctime": "2018-06-21 16:53:25,507",
168168
"custom_key": "custom value",
169169
"exc": null,
@@ -177,7 +177,7 @@ The command line tool called ``spy`` is included with the pip on install. When y
177177
"tags": [],
178178
"timestamp": 1529625205.5072436
179179
}
180-
spy - INFO - done
180+
sp - INFO - done
181181

182182
Logging to Splunk from a Python Shell
183183
-------------------------------------
@@ -425,7 +425,7 @@ Please refer to the command line tool's updated usage prompt for help searching
425425

426426
::
427427

428-
usage: spy [-h] [-u USER] [-p PASSWORD] [-f DATAFILE] [-i INDEX_NAME]
428+
usage: sp [-h] [-u USER] [-p PASSWORD] [-f DATAFILE] [-i INDEX_NAME]
429429
[-a ADDRESS] [-e EARLIEST_TIME_MINUTES] [-l LATEST_TIME_MINUTES]
430430
[-v VERIFY] [-s]
431431

@@ -445,6 +445,12 @@ Please refer to the command line tool's updated usage prompt for help searching
445445
-v VERIFY verify certs - disabled by default
446446
-s silent
447447

448+
For trying the host-only compose file, you may see errors like:
449+
450+
```unable to resolve host splunkenterprise```
451+
452+
Please add ```splunkenterprise``` to the end of the line for ```127.0.0.1``` in your ```/etc/hosts```
453+
448454
Cleanup
449455
-------
450456

‎docs/source/index.rst

+15-15
Original file line numberDiff line numberDiff line change
@@ -86,22 +86,22 @@ Please wait a few while the container is getting ready. You may see output like
8686
Get Splunk Logs from the Command Line Tool
8787
------------------------------------------
8888

89-
Use the command line tool: **spy** to search for recent logs.
89+
Use the command line tool: **sp** to search for recent logs.
9090

9191
::
9292

93-
spy
93+
sp
9494

9595
Which will log something like:
9696

9797
::
9898

99-
spy - INFO - creating client user=trex address=localhost:8089 login=localhost:8089
100-
spy - INFO - connecting trex@localhost:8089
101-
spy - INFO - No matches for search={
99+
sp - INFO - creating client user=trex address=localhost:8089 login=localhost:8089
100+
sp - INFO - connecting trex@localhost:8089
101+
sp - INFO - No matches for search={
102102
"search": "search index=\"antinex\" | head 10"
103103
}
104-
spy - INFO - done
104+
sp - INFO - done
105105

106106
Write Splunk Logs
107107
-----------------
@@ -120,13 +120,13 @@ By default the container creates an **antinex** index with a user token for the
120120
Get the Test Splunk Logs using the Command Line Tool
121121
----------------------------------------------------
122122

123-
The command line tool called ``spy`` is included with the pip on install. When you run it, it will return the most recent logs from the index (``antinex`` by default) and print them to stdout.
123+
The command line tool called ``sp`` is included with the pip on install. When you run it, it will return the most recent logs from the index (``antinex`` by default) and print them to stdout.
124124

125125
::
126126

127-
spy - INFO - creating client user=trex address=localhost:8089 login=localhost:8089
128-
spy - INFO - connecting trex@localhost:8089
129-
spy - ERROR - {
127+
sp - INFO - creating client user=trex address=localhost:8089 login=localhost:8089
128+
sp - INFO - connecting trex@localhost:8089
129+
sp - ERROR - {
130130
"asctime": "2018-06-21 16:53:25,509",
131131
"custom_key": "custom value",
132132
"exc": null,
@@ -140,7 +140,7 @@ The command line tool called ``spy`` is included with the pip on install. When y
140140
"tags": [],
141141
"timestamp": 1529625205.5090911
142142
}
143-
spy - CRITICAL - {
143+
sp - CRITICAL - {
144144
"asctime": "2018-06-21 16:53:25,508",
145145
"custom_key": "custom value",
146146
"exc": null,
@@ -154,7 +154,7 @@ The command line tool called ``spy`` is included with the pip on install. When y
154154
"tags": [],
155155
"timestamp": 1529625205.5082061
156156
}
157-
spy - ERROR - {
157+
sp - ERROR - {
158158
"asctime": "2018-06-21 16:53:25,507",
159159
"custom_key": "custom value",
160160
"exc": null,
@@ -168,7 +168,7 @@ The command line tool called ``spy`` is included with the pip on install. When y
168168
"tags": [],
169169
"timestamp": 1529625205.5078382
170170
}
171-
spy - INFO - {
171+
sp - INFO - {
172172
"asctime": "2018-06-21 16:53:25,507",
173173
"custom_key": "custom value",
174174
"exc": null,
@@ -182,7 +182,7 @@ The command line tool called ``spy`` is included with the pip on install. When y
182182
"tags": [],
183183
"timestamp": 1529625205.5072436
184184
}
185-
spy - INFO - done
185+
sp - INFO - done
186186

187187
Logging to Splunk from a Python Shell
188188
-------------------------------------
@@ -430,7 +430,7 @@ Please refer to the command line tool's updated usage prompt for help searching
430430

431431
::
432432

433-
usage: spy [-h] [-u USER] [-p PASSWORD] [-f DATAFILE] [-i INDEX_NAME]
433+
usage: sp [-h] [-u USER] [-p PASSWORD] [-f DATAFILE] [-i INDEX_NAME]
434434
[-a ADDRESS] [-e EARLIEST_TIME_MINUTES] [-l LATEST_TIME_MINUTES]
435435
[-v VERIFY] [-s]
436436

‎docs/source/scripts.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ Examples and Scripts
44
Search Splunk with a Dictionary
55
===============================
66

7-
The command line client ``spy`` is actually a copy of the ``search_splunk.py`` script. Note, this will likely change in the future, but for now this makes the docs easy to host on RTD.
7+
The command line client ``sp`` is actually a copy of the ``search_splunk.py`` script. Note, this will likely change in the future, but for now this makes the docs easy to host on RTD.
88

99
.. automodule:: spylunking.scripts.search_splunk
1010
:members: run_main

‎host-network-compose.yml

+101
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
version: '3'
2+
3+
services:
4+
splunkenterprise:
5+
6+
hostname: splunkenterprise
7+
container_name: "splunk"
8+
image: splunk/splunk:7.0.3
9+
environment:
10+
SPLUNK_START_ARGS: --accept-license --answer-yes
11+
SPLUNK_ENABLE_LISTEN: 9997
12+
SPLUNK_ADD: tcp 1514
13+
network_mode: "host"
14+
entrypoint: "/bin/sh -c '/bin/echo \"starting entrypoint\"
15+
&& cd /opt/splunk
16+
&& /bin/date -u +\"%Y-%m-%d %H:%M:%S\" > /opt/splunk/service.log
17+
&& /bin/date -u +\"%Y-%m-%d %H:%M:%S\" > /opt/splunk/boot.log
18+
&& /bin/date -u +\"%Y-%m-%d %H:%M:%S\"
19+
&& touch ./etc/.ui_login
20+
&& /bin/echo \"building splunk starter\" >> /opt/splunk/boot.log
21+
&& /bin/echo \"#!/bin/bash\" >> /opt/start-all.sh
22+
&& /bin/echo \"/usr/bin/nohup /bin/bash /sbin/entrypoint.sh start-service >> /opt/splunk/service.log \" >> /opt/start-all.sh
23+
&& /bin/chmod 777 /opt/start-all.sh
24+
&& /bin/cat /opt/start-all.sh >> /opt/splunk/boot.log
25+
&& /bin/echo \"running splunk starter\" >> /opt/splunk/boot.log
26+
&& /usr/bin/nohup /opt/start-all.sh & >> /opt/splunk/boot.log
27+
&& /bin/echo \"sleeping for startup\" >> /opt/splunk/boot.log
28+
&& sleep 20
29+
&& /bin/echo \"\" >> /opt/splunk/boot.log
30+
&& /bin/echo \"loading remote login\"
31+
&& /bin/date -u +\"%Y-%m-%d %H:%M:%S\"
32+
&& /bin/date -u +\"%Y-%m-%d %H:%M:%S\" >> /opt/splunk/boot.log
33+
&& /bin/date -u +\"%Y-%m-%d %H:%M:%S\" >> /opt/splunk/service.log
34+
&& /bin/echo \"installing remote login support\" >> /opt/splunk/boot.log
35+
&& sed -i \"/\\[general\\]/aallowRemoteLogin = always\"
36+
/opt/splunk/etc/system/local/server.conf
37+
&& /bin/echo \"\" >> /opt/splunk/boot.log
38+
&& cat /opt/splunk/etc/system/local/server.conf >> /opt/splunk/boot.log
39+
&& /bin/echo \"\" >> /opt/splunk/boot.log
40+
&& /bin/echo \"\" >> /opt/splunk/service.log
41+
&& /bin/echo \"\"
42+
&& /bin/date -u +\"%Y-%m-%d %H:%M:%S\" >> /opt/splunk/boot.log
43+
&& /bin/date -u +\"%Y-%m-%d %H:%M:%S\" >> /opt/splunk/service.log
44+
&& /bin/echo \"creating user\" >> /opt/splunk/boot.log
45+
&& /bin/echo \"creating user\"
46+
&& ./bin/splunk add user trex -password 123321 -role admin -auth admin:changeme
47+
&& /bin/echo \"creating index antinex\" >> /opt/splunk/boot.log
48+
&& /bin/echo \"creating index antinex\" >> /opt/splunk/service.log
49+
&& ./bin/splunk add index antinex -auth \"trex:123321\" >> /opt/splunk/boot.log
50+
&& /bin/echo \"enabling HEC in Global Settings\" >> /opt/splunk/boot.log
51+
&& /bin/echo \"enabling HEC in Global Settings\" >> /opt/splunk/service.log
52+
&& ./bin/splunk http-event-collector enable -uri https://localhost:8089 -auth \"trex:123321\" >> /opt/splunk/boot.log
53+
&& /bin/echo \"creating token\" >> /opt/splunk/boot.log
54+
&& ./bin/splunk
55+
http-event-collector create
56+
antinex-token \"antinex-token\"
57+
-index antinex
58+
-sourcetype json
59+
-uri \"https://localhost:8089\"
60+
-auth \"trex:123321\"
61+
&& /bin/echo \"enabling Token for HEC access\" >> /opt/splunk/boot.log
62+
&& /bin/echo \"enabling Token for HEC access\" >> /opt/splunk/service.log
63+
&& ./bin/splunk
64+
http-event-collector enable
65+
-uri https://localhost:8089
66+
-name antinex-token
67+
-auth \"trex:123321\" >> /opt/splunk/boot.log
68+
&& /bin/echo \"\"
69+
&& /bin/echo \"restarting splunk\" >> /opt/splunk/boot.log
70+
&& /bin/echo \"restarting splunk\" >> /opt/splunk/service.log
71+
&& ./bin/splunk restart >> /opt/splunk/service.log
72+
&& /bin/echo \"done restarting splunk\" >> /opt/splunk/boot.log
73+
&& /bin/echo \"done restarting splunk\" >> /opt/splunk/service.log
74+
&& /bin/echo \"\" >> /opt/splunk/boot.log
75+
&& /bin/echo \"\" >> /opt/splunk/service.log
76+
&& /bin/echo \"Boot completed.\"
77+
&& /bin/echo \"Boot completed.\" >> /opt/splunk/boot.log
78+
&& /bin/date -u +\"%Y-%m-%d %H:%M:%S\"
79+
&& /bin/echo \"\"
80+
&& /bin/echo \"Debugging tools:\"
81+
&& /bin/echo \"\"
82+
&& /bin/echo \"Tail the boot log:\"
83+
&& /bin/echo \"docker exec -it splunk /usr/bin/tail -f /opt/splunk/boot.log\"
84+
&& /bin/echo \"Tail the startup log:\"
85+
&& /bin/echo \"docker exec -it splunk /usr/bin/tail -f /opt/splunk/service.log\"
86+
&& /bin/echo \"\"
87+
&& /bin/echo \"Pull the boot log:\"
88+
&& /bin/echo \"./logs.sh b\"
89+
&& /bin/echo \"Pull the startup log:\"
90+
&& /bin/echo \"./logs.sh s\"
91+
&& /bin/echo \"Pull the docker log:\"
92+
&& /bin/echo \"./logs.sh d\"
93+
&& /bin/echo \"Tail the docker log:\"
94+
&& /bin/echo \"./logs.sh\"
95+
&& tail -f /opt/splunk/service.log'"
96+
ports:
97+
- "8000:8000"
98+
- "9997:9997"
99+
- "8089:8089"
100+
- "8088:8088"
101+
- "1514:1514"

‎setup.py

+2-2
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ def run_tests(self):
6363
setup(
6464
name='spylunking',
6565
cmdclass={'test': PyTest},
66-
version='1.0.8',
66+
version='1.0.9',
6767
description=(
6868
'Splunk-ready python logging integration, Docker demos and tools'),
6969
long_description=(
@@ -88,7 +88,7 @@ def run_tests(self):
8888
'./spylunking/scripts/show_service_token.py',
8989
'./spylunking/scripts/search_splunk.py',
9090
'./spylunking/scripts/test_logging.py',
91-
'./spylunking/scripts/spy'
91+
'./spylunking/scripts/sp'
9292
],
9393
use_2to3=True,
9494
classifiers=[

‎spylunking/scripts/spy ‎spylunking/scripts/sp

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ from spylunking.ppj import ppj
1717

1818

1919
log = build_colorized_logger(
20-
name='spy',
20+
name='sp',
2121
handler_name='simple')
2222
# additional optional args:
2323
#

0 commit comments

Comments
 (0)