Splunk Management Utility
| Follow us on 
This library is an abstraction for Splunk-related development, maintenance, or migration operations. It provides a single CLI or SDK to conveniently perform various operations such as managing a local development container, retrieving sample-data, building applications, comparing instances, managing knowledge objects and hopefully much more in the future.
Motivation
🔥
When I work with Splunk, my working directory is usually in the same layout. I work with a mono-repository or a higher-level one with submodules, which contains several applications and configuration. This can look generalized like this:
├── apps # Folder where to store applications
│ └── Defender_TA_nxtp # Generic custom Splunk app
├── dist # Place for built packages and reports
├── scripts
├── config # Settings and secrets
│ └── settings.yaml # General purpose settings for this lib
│ └── .secrets.yaml # API settings for connections and secrets
└── share # Custom splunkbase or builtin app content
We have all found our ways and methods to develop applications on an instance and to configure and operate that instance to meet our needs and/or those of our customers. But what is usually rather painful is when we then need them on other instances as well. A good example are test instances, which should be as close to production as possible. However, in the last few years that I have been dealing as a user with Splunk, some needs for simplified handling and automation have emerged that I would like to address here.
We want to ...
-
Spin up a local development container:
spl docker start
-
Put my local application(s) there for testing purposes:
spl docker upload --app="Defender*" -
Get sample data for Eventgen:
spl --src="onprem" samples --path="./apps/SA-Eventgen" download --name="WinDefender"
-
(De)activate streaming of event data.
-
Download apps from development container to local folder:
spl docker download --app="Defender*" -
Run AppInspect, Packaging, etc.:
spl apps --name="Defender_TA*" validate -
List various objects on an instance:
spl manager --conn="onprem" users list -
Create or modify objects on an instance:
spl manager --conn="onprem" roles update --name "investigator"
-
Sync objects and their properties from one instance to another:
spl --src="onprem" --dest="localhost" sync users --create --update
and probably much more, so pull requests are welcome!
Getting Started
🚀
You can download the package from the package feed via pip install spl-manager or install from source with poetry after cloning the repository.
Then you can issue your first command to get the help page:
python -m spl -h
or poetry run python -m spl -h. Anyhow it's recommended to set the alias spl="python -m spl for easier handling.
You have to create a config\.secrets.yaml file by using the config\template.secrets.yaml file, which contains the credentials for the Development Docker-Container and Splunkbase.
Using the library
📚
Please note that, when using the library as an SDK you need to pass the interactive=False flag to not run into issues because in interactive mode it asks for user inputs via CLI methods.
from spl import SplManager
spl = SplManager(interactive=False)
Using the CLI
🧑💻
If you wish to get more information about any command within spl, you can pass the -h parameter.
Top-level spl Options
--interactive: Wether or not to run in interactive mode.--src: The name of the source connection provided in settings.--dest: The name of the destination connection provided in settings.
Top-level spl Modules
-
connectionsprovides you a list of connections available via configuration. -
dockerhelps you to manage the local splunk container instance. -
appsabstracts the handling of local application folders at a given--pathand helps with validation, packaging, vetting, etc. -
samplesare based on the configured queries for a--connor--srcand can download results and store them automatically at a--pathto use for SA-Eventgen. -
manageracts as a directConnectionAdapterinterface for the specified--connparameter. -
syncwill handlemanagers for--srcand--destconnections, enabling you to compare, move and update between those instances.
🔗
References
- Splunk Python SDK
- Python Docker SDK (low-level API)
- Python Rich Outputs
- InquirerPy User Inputs
- Python Fire CLI
- DeepDiff
- Cerberus Schema Validation
- Splunk AppInspect
- Splunk Packaging Toolkit
- Splunk Eventgen
🤩
Support
| Protocol | Address |
|---|---|
| Ethereum | 0xcFC6Bdb68FB219de754D01BcD34F8A339549C910 |
| Avalanche | X-avax1vlrw8m9af5p4kx2zxc4d5lqmgh8c86uduwprg6 |
| Harmony | one18fcze47fll6662ggr760u9jm3rfz859jkv7vyw |
| Binance Chain | bnb1q6zg3pnmclnfhy6vtldfd0az97l0ndayun2tzn |
| Binance Smart Chain | 0x1CD0ca3eC911Fe9661905Dd500FBaCE245c7013f |
| Solana | Eh35fdT6gdMHcsj3TrTMnNDSgvWAEMc11Zhz9R96F7aB |
4 Oct 29, 2021
353 Jan 04, 2023
3 Feb 02, 2022
9 Mar 12, 2022
1 Oct 22, 2021
42 May 28, 2021
3 Apr 23, 2022
1 Jan 30, 2022
3 Jan 06, 2022
492 Dec 27, 2022
10 Apr 12, 2022
15 Nov 27, 2022
1 Jan 09, 2022
2 Jan 25, 2022
1 Jan 04, 2022
45 Dec 20, 2021
267 Dec 29, 2022
4 Sep 02, 2022
1 Nov 10, 2022
170 Dec 15, 2022