Getting Data In

Testing Splunk UF config on Windows, with Inspec.

northernstar002
New Member

Hi,

I have 2 installations of Splunk. One on a Linux image, one on a Windows 2016 image - both on AWS.

I am testing that that both Trend and Splunk are configured correctly. I have a complete set of tests for the Linux version, but I'm having trouble refactoring for Windows Powershell (I am running my tests remotely and RDP-ing to the Windows VM.

My Linux code is as follows:


Splunk_Server = attribute('Splunk_Server')
Splunk_User = attribute('Splunk_User')
Splunk_Password = attribute('Splunk_Password')

describe command("sudo /opt/splunkforwarder/bin/splunk list forward-server -auth #{Splunk_User}:#{Splunk_Password}") do
its ('stdout') {should match /^Active.forwards:\n\t#{Splunk_Server}\nConfigured.but.inactive.forwards:\n\tNone/}

end


So, I want to read the output of the Linux command and have Inspec verify the output. The command will obviously change for Powershell. Any ideas what this would be to obtain the same result?

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...