Getting Data In

I want to distinguish between servers which are down and servers which have stopped splunkd service. After that I need to create a button in Dashboard which will trigger a script which will go to the respective server and take the necessary action.

sandyIscream
Communicator

I want to distinguish between servers which are down and servers which have stopped splunkd service. After that I need to create a button in Dashboard which will trigger a script which will go to the respective server and take the necessary action.

Currently our client wants a dashboard where we can see the down agents and a button after that to trigger a script that will up the Splunk agent.

Please tell whether it's possible or not ?

Thanks in Advance.

0 Karma

acharlieh
Influencer

In theory, it's possible... You'll likely want to pull data and APIs from your Endpoint Monitoring/Management solution (something like Tanium), and you probably also want to bring in data from your change management/ticketing system, inventory & asset management, and configuration management systems as well.

But as you develop such make sure you are considering the security implications of having that button as well, guard against the possibility of someone being able to pervert the ability to start a service to become an arbitrary privileged command and control mechanism across your client's enterprise.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...