Juttle adapter for Splunk
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
lib
test
.eslintrc
.gitignore
.travis.yml
CHANGELOG.md
LICENSE
NOTICE
README.md
index.js
package.json

README.md

Juttle Splunk Adapter

Build Status

Splunk adapter for the Juttle data flow language, with read support.

Currently supports Splunk 6.3.

Examples

Read entries from the _internal index where the host is www123:

read splunk index='_internal' host='www123' | view text

Installation

Like Juttle itself, the adapter is installed as a npm package. Both Juttle and the adapter need to be installed side-by-side:

$ npm install juttle
$ npm install juttle-splunk-adapter

Configuration

The adapter needs to be registered and configured so that it can be used from within Juttle. To do so, add the following to your ~/.juttle/config.json file:

{
    "adapters": {
        "splunk": {
            "scheme": "https",
            "host": "localhost",
            "port": "8089",
            "username": "admin",
            "password": "splunk"
        }
    }
}

The scheme, host and port should point to the API url of your Splunk instance. The default settings of https, localhost and 8089 will be used as defaults.

Please note that Splunk 6.3 won't allow access to the API if default admin password changeme is used. To enable it, please change the password and update the Juttle config accordingly.

Usage

Read options

When reading data, large part of SPL syntax is expressible through and similar to Juttle filter expressions.

Notable omissions, which aren't translated from Juttle to SPL are:

  • Juttle supports in operator for testing inclusion of a value in an array. This operator is missing from SPL. This Juttle query can be rewritten using a sequence of or operators.

  • Juttle supports filtering results using regular expression operators on fields - =~ and !~. Instead, SPL uses | regex filter to accomplish a similar task. Same pattern can be used in Juttle - read splunk ... | filter field =~ /regexp/.

The following options are supported by read:

Name Type Required Description
fields string no additional fields to add to the results (default: none)
from moment no select points after this time (inclusive)
to moment no select points before this time (exclusive)

The filter expressions can be placed after the above options in read splunk. Supported filters are:

  • fieldname = value also !=, and </> for numbers
  • combining filter expressions with AND, OR, NOT

Contributing

Want to contribute? Awesome! Don’t hesitate to file an issue or open a pull request.