diff --git a/apps/alert_logevent/README/alert_actions.conf.spec b/apps/alert_logevent/README/alert_actions.conf.spec new file mode 100755 index 00000000..261f052a --- /dev/null +++ b/apps/alert_logevent/README/alert_actions.conf.spec @@ -0,0 +1,16 @@ +[logevent] + +param.event = +* Default value for event content sent to the receiver endpoint, which is eventually indexed + +param.host = +* Default field value of the host field of the newly indexed event + +param.source = +* Default field value of the source field of the newly indexed event + +param.sourcetype = +* Default field value of the sourcetype field of the newly indexed event + +param.index = +* Default field value for the destination index of the newly indexed event diff --git a/apps/alert_logevent/README/savedsearches.conf.spec b/apps/alert_logevent/README/savedsearches.conf.spec new file mode 100755 index 00000000..98b928f4 --- /dev/null +++ b/apps/alert_logevent/README/savedsearches.conf.spec @@ -0,0 +1,19 @@ +# Log event action settings + +action.log_event = [0|1] +* Enable log event action + +action.logevent.param.event = +* Event content sent to the receiver endpoint, which is eventually indexed + +action.logevent.param.host = +* Field value of the host field of the newly indexed event + +action.logevent.param.source = +* Field value of the source field of the newly indexed event + +action.logevent.param.sourcetype = +* Field value of the sourcetype field of the newly indexed event + +action.logevent.param.index = +* Destination index of the newly indexed event diff --git a/apps/alert_logevent/appserver/static/logevent.png b/apps/alert_logevent/appserver/static/logevent.png new file mode 100755 index 00000000..ef06054c Binary files /dev/null and b/apps/alert_logevent/appserver/static/logevent.png differ diff --git a/apps/alert_logevent/bin/logevent.py b/apps/alert_logevent/bin/logevent.py new file mode 100755 index 00000000..c030cba9 --- /dev/null +++ b/apps/alert_logevent/bin/logevent.py @@ -0,0 +1,55 @@ +from __future__ import annotations +import sys +import json +from future.moves.urllib.parse import urlencode +from future.moves.urllib.request import urlopen, Request +from future.moves.urllib.error import HTTPError, URLError +from splunk.util import unicode + +def log_event(settings, event, source, sourcetype, host, index) -> bool: + if event is None: + sys.stderr.write("ERROR No event provided\n") + return False + query = [('source', source), ('sourcetype', sourcetype), ('index', index)] + if host: + query.append(('host', host)) + url = '%s/services/receivers/simple?%s' % (settings.get('server_uri'), urlencode(query)) + try: + encoded_body = unicode(event).encode('utf-8') + req = Request(url, encoded_body, {'Authorization': 'Splunk %s' % settings.get('session_key')}) + res = urlopen(req) + if 200 <= res.code < 300: + sys.stderr.write("DEBUG receiver endpoint responded with HTTP status=%d\n" % res.code) + return True + else: + sys.stderr.write("ERROR receiver endpoint responded with HTTP status=%d\n" % res.code) + return False + except HTTPError as e: + sys.stderr.write("ERROR Error sending receiver request: %s\n" % e) + except URLError as e: + sys.stderr.write("ERROR Error sending receiver request: %s\n" % e) + except Exception as e: + sys.stderr.write("ERROR Error %s\n" % e) + return False + + +if __name__ == "__main__": + if len(sys.argv) < 2 or sys.argv[1] != "--execute": + sys.stderr.write("FATAL Unsupported execution mode (expected --execute flag)\n") + sys.exit(1) + try: + settings = json.loads(sys.stdin.read()) + config = settings['configuration'] + success = log_event( + settings, + event=config.get('event'), + source=config.get('source'), + sourcetype=config.get('sourcetype'), + host=config.get('host'), + index=config.get('index') + ) + if not success: + sys.exit(2) + except Exception as e: + sys.stderr.write("ERROR Unexpected error: %s\n" % e) + sys.exit(3) diff --git a/apps/alert_logevent/default/alert_actions.conf b/apps/alert_logevent/default/alert_actions.conf new file mode 100755 index 00000000..503d275b --- /dev/null +++ b/apps/alert_logevent/default/alert_actions.conf @@ -0,0 +1,12 @@ +[logevent] +python.version = latest +is_custom = 1 +label = Log Event +description = Send log event to Splunk receiver endpoint +icon_path = logevent.png +payload_format = json + +param.source = alert:$name$ +param.sourcetype = generic_single_line +param.host = +param.index = main \ No newline at end of file diff --git a/apps/alert_logevent/default/app.conf b/apps/alert_logevent/default/app.conf new file mode 100755 index 00000000..5d1cdcf0 --- /dev/null +++ b/apps/alert_logevent/default/app.conf @@ -0,0 +1,18 @@ +# Version 10.0.2 +# +# Splunk app configuration file +# + +[ui] +is_visible = 0 +label = Log Event Alert Action + +[launcher] +author = Splunk +description = Log Event Alert Action +version=10.0.2 + +[install] +state = enabled +is_configured = 1 +allows_disable = false diff --git a/apps/alert_logevent/default/data/ui/alerts/logevent.html b/apps/alert_logevent/default/data/ui/alerts/logevent.html new file mode 100755 index 00000000..14c7a0ac --- /dev/null +++ b/apps/alert_logevent/default/data/ui/alerts/logevent.html @@ -0,0 +1,76 @@ +
+
+ + +
+ +
+
+
+
+ + Specify event text for the logged event. +
+ Learn More + + +
+
+
+ + +
+ +
+
+
+
+ + Value of the source field. + +
+
+
+ + +
+ +
+
+
+
+ + Value of the sourcetype field. + +
+
+
+ + +
+ +
+
+
+
+ + Value of the host field. + +
+
+
+ + +
+ +
+
+
+
+ + Indicate a destination index for the logged event. Ensure that destination matches an existing index. + +
+
+
\ No newline at end of file diff --git a/apps/alert_logevent/default/restmap.conf b/apps/alert_logevent/default/restmap.conf new file mode 100755 index 00000000..c0298006 --- /dev/null +++ b/apps/alert_logevent/default/restmap.conf @@ -0,0 +1,3 @@ +[validation:savedsearch] +# Require event to be set if logevent action is enabled +action.logevent = case('action.logevent' != "1", null(), 'action.logevent.param.event' == "action.logevent.param.event" OR 'action.logevent.param.event' == "", "No event text specified for log event action", 1==1, null()) diff --git a/apps/alert_logevent/metadata/default.meta b/apps/alert_logevent/metadata/default.meta new file mode 100755 index 00000000..ddb8b569 --- /dev/null +++ b/apps/alert_logevent/metadata/default.meta @@ -0,0 +1,13 @@ +# Application-level permissions + +[] +access = read : [ * ], write : [ admin, power ] + +[alert_actions] +export = system + +[alerts] +export = system + +[restmap] +export = system \ No newline at end of file