Skip to content

A search command for Splunk which will allow you to search Elastic Search and display the results in the Splunk GUI

License

Notifications You must be signed in to change notification settings

Yradio/splunk-elasticsearch

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

37 Commits
 
 
 
 
 
 
 
 

Repository files navigation

splunk-elasticsearch

I have created a search command for Splunk which will allow you to search Elastic Search and display the results in the Splunk GUI

This project is now a valid splunk application and installs as you would any other splunk applications Steps
Install python if it is not installed

Install ElasticSearch https://github.com/elasticsearch/elasticsearch-py
"pip install elasticsearch "

This project is now a Splunk Application so just copy the splunk-elasticsearch directory to your splunk $SPLUNK_HOME/etc/apps directory and should work

====================================================== git clone "This Project"
rsync -av splunk-elasticsearch $SPLUNK_HOME/etc/apps

Now you should be able to do a simple search like
| esearch | top message

or
| esearch oldest=now-100d earliest=now query="some text" index=nagios* limit=1000 field=message

================================================
command reference:
esearch
oldest = default (now-1d) uses elasticsearch timedate value or function
earliest = default (now) uses elasticsearch timedate value or function
index = default () sepecify the elasticsearch index to search
limit = default (50) number of records to return
field = default ("message") which elasticsearch field to query and return the value
query = default ("
" | might change this to match_all) the elasticsearch query_string

About

A search command for Splunk which will allow you to search Elastic Search and display the results in the Splunk GUI

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 100.0%