Splunk - Forward File | Octopus Integrations

Octopus.Script exported 2014-05-16 by bobjwalker belongs to ‘Splunk’ category.

Configures splunk forwarding for the specified file. (The splunk forwarder service should be installed on the target server)

Parameters

When steps based on the template are included in a project’s deployment process, the parameters below can be set.

File

File

The path to the file to forward

Index

Index

The Splunk index to forward to

App name

AppName

The application name outputting to the file

Script body

Steps based on this template will execute the following PowerShell script.

$file = $OctopusParameters['File']
$index = $OctopusParameters['Index']
$appName = $OctopusParameters['AppName']

# Enable splunk forwarding

Set-Service SplunkForwarder -startuptype Automatic

# Create log file

if(!(Test-Path "$file"))
{
    Write-Host "Creating new log file"
    New-Item "$file" -type File -Force
}
else
{
    Write-Host "Log file already exists"
}

# Create/prepare splunk forwarder directory

$appPath = "$env:ProgramFiles\SplunkUniversalForwarder\etc\apps\$appName\default"

if(Test-Path "$appPath")
{
    Write-Host "Splunk app directory already exists. Removing existing configs"
	
	# Remove-Item recursion does not work correctly - http://technet.microsoft.com/library/hh849765.aspx (-Recurse section)
    # Remove files first then directories (leaf -> root) so we don't get the recursion confirm popup
    Get-ChildItem $appPath -Recurse | Where { ! $_.PSIsContainer } | Remove-Item -Force
    Get-ChildItem $appPath -Recurse | Where { $_.PSIsContainer } | Sort @{ Expression = { $_.FullName.length } } -Descending | Remove-Item -Force
}
else
{
    Write-Host "Creating splunk app directory"
    New-Item "$appPath" -type Directory
}

# Create forwarder config

Write-Host "Creating splunk forwarder config"

$str = "[monitor://$file]`r`ndisabled = false`r`nfollowTail = 0`r`nsourcetype = $appName`r`nindex = $index"
New-Item "$appPath\inputs.conf" -type File -value $str

# Restart forwarder service

Write-Host "Restarting splunk forwarder"
Restart-Service "SplunkForwarder"

Provided under the Apache License version 2.0.

Report an issue

To use this template in Octopus Deploy, copy the JSON below and paste it into the Library → Step templates → Import dialog.

{
  "Id": "0e5d7444-1be1-47c4-a776-ec0f51cf04b3",
  "Name": "Splunk - Forward File",
  "Description": "Configures splunk forwarding for the specified file. (The splunk forwarder service should be installed on the target server)",
  "Version": 3,
  "ExportedAt": "2014-05-16T10:27:19.192+00:00",
  "ActionType": "Octopus.Script",
  "Author": "bobjwalker",
  "Parameters": [
    {
      "Name": "File",
      "Label": "File",
      "HelpText": "The path to the file to forward",
      "DefaultValue": null,
      "DisplaySettings": {
        "Octopus.ControlType": "SingleLineText"
      }
    },
    {
      "Name": "Index",
      "Label": "Index",
      "HelpText": "The Splunk index to forward to",
      "DefaultValue": null,
      "DisplaySettings": {
        "Octopus.ControlType": "SingleLineText"
      }
    },
    {
      "Name": "AppName",
      "Label": "App name",
      "HelpText": "The application name outputting to the file",
      "DefaultValue": null,
      "DisplaySettings": {
        "Octopus.ControlType": "SingleLineText"
      }
    }
  ],
  "Properties": {
    "Octopus.Action.Script.ScriptBody": "$file = $OctopusParameters['File']\n$index = $OctopusParameters['Index']\n$appName = $OctopusParameters['AppName']\n\n# Enable splunk forwarding\n\nSet-Service SplunkForwarder -startuptype Automatic\n\n# Create log file\n\nif(!(Test-Path \"$file\"))\n{\n    Write-Host \"Creating new log file\"\n    New-Item \"$file\" -type File -Force\n}\nelse\n{\n    Write-Host \"Log file already exists\"\n}\n\n# Create/prepare splunk forwarder directory\n\n$appPath = \"$env:ProgramFiles\\SplunkUniversalForwarder\\etc\\apps\\$appName\\default\"\n\nif(Test-Path \"$appPath\")\n{\n    Write-Host \"Splunk app directory already exists. Removing existing configs\"\n\t\n\t# Remove-Item recursion does not work correctly - http://technet.microsoft.com/library/hh849765.aspx (-Recurse section)\n    # Remove files first then directories (leaf -> root) so we don't get the recursion confirm popup\n    Get-ChildItem $appPath -Recurse | Where { ! $_.PSIsContainer } | Remove-Item -Force\n    Get-ChildItem $appPath -Recurse | Where { $_.PSIsContainer } | Sort @{ Expression = { $_.FullName.length } } -Descending | Remove-Item -Force\n}\nelse\n{\n    Write-Host \"Creating splunk app directory\"\n    New-Item \"$appPath\" -type Directory\n}\n\n# Create forwarder config\n\nWrite-Host \"Creating splunk forwarder config\"\n\n$str = \"[monitor://$file]`r`ndisabled = false`r`nfollowTail = 0`r`nsourcetype = $appName`r`nindex = $index\"\nNew-Item \"$appPath\\inputs.conf\" -type File -value $str\n\n# Restart forwarder service\n\nWrite-Host \"Restarting splunk forwarder\"\nRestart-Service \"SplunkForwarder\"",
    "Octopus.Action.Script.Syntax": "PowerShell"
  },
  "Category": "Splunk",
  "HistoryUrl": "https://github.com/OctopusDeploy/Library/commits/master/step-templates//opt/buildagent/work/75443764cd38076d/step-templates/splunk-forward-file.json",
  "Website": "/step-templates/0e5d7444-1be1-47c4-a776-ec0f51cf04b3",
  "Logo": "iVBORw0KGgoAAAANSUhEUgAAAMgAAADICAMAAACahl6sAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAD9QTFRFQUFBAAAAmpqazeXKKCgor9er////f39/arNhv7+/z8/P7+/vYGBg39/fr6+vfr12cHBw7PXrj8aJ9vr1c7hrbhrLqwAAA3RJREFUeNrs2ul2oyAYgGEkRCqItc3c/7VOXEDQaMEkZ5bz8qtiRR6WD7AV9X+SBBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQIAAAQIECBAgQP4gpBdD6k8+LZ96+qUQUQ3pbFn6qaeBAAECBAiQ90NMp7VsNtm2kfd8cxZi7k/rzu5AzOshUlVTEt39qpl+vv8g5myl7RqyJk3XOq5uKLV1jyCyUtIbL5dXQKx/4fjSBdJH2cqUQqyIHjdbSONfN6Trx+fleUjsqJoAaaskmTKISkqt3BpiqhTykUvZh8i5yK6RouqXoTXUptfaN6y4FUFWqV1BbOIYIZmUXcitDVWo63FiNsnbw6UshQwzwPh2sAlkHnfeUV8+PnIp4oeQ2i0ZvuYivVaFEBffGJtBr55Wyzu/rrkUkb82NFEjjmmeLV0RRKelJfFsKlDZuBpf119ZlJ8gSzeHyR4yuimjL4KEWm4hczi4rQd5FmUf4jtAuTQjGmxhqBVErf3ALB/0Rz7lIPyGONslELfptMIF8TiePV7Xb9fPmfLUgtjHkPqtkP36XCbKqS1K6BNh3w9RcaM97JXP05BbFzfUmyHzHBkDcr0/T87ufv3w0vsQ9SKIHwCmPpruZ88j1g+vAGnWUas9glT5kNs8KbdxK2dZ/PkMIXz9Z4i8rdYReQBxBZCwYxQ7jO9z60gYXSuIWscCu4VUq51nJsTHr76YcQSxNhkdTbJLXO24xboq8+/YqgwS78CKGMe73yZuVLfsfqfZ6NSyQC6QLtbGoSIP4tJl8ZLLOIAM1W5N7WQYt8t5RN/z/Som0/NIOI4pIZYzVDbEN8Q84a+5jANIepKLTogPTkYxRKb3VSHETzwRIN9PnhDTE61cFkQTE/vtlr9NjvSiFOI3RnKCfD9/Zm+WrwTCxHut5fOBah6dXZY+6W1dDBljiJLT1tR9veRzkBv/lNTPhUYru9PDDb0swaYZkr+2sr3fbsePOtOdoQSX/M7BHande780brcof1MCAgQIECBAgJRBzPi/L+Lfh/zdCQgQIECAAAECBAgQIECAAAECBAgQIECAAAECBAgQIECAAAECBAgQIECAAAECBAgQIECAAAECBAgQIECAAAECBAgQIOfSbwEGAHvPjDxexE/EAAAAAElFTkSuQmCC",
  "$Meta": {
    "Type": "ActionTemplate"
  }
}

History

Page updated on Friday, May 16, 2014