Getting Data In

Using field values in a bash script

xureal
New Member

Hello,

I'm trying to write a shell script in response to attempted ssh logins from multiple IP addresses. I have used rex to create a username field in my search since splunk couldn't grab the data itself, and was wondering if there is any way of passing the value of the field into my shell script.

My search:
eventtype=ssh-login-attempt | rex field=_raw "User '(?\w+)"

I'm looking to get the value of the username field into my shell script.

Tags (2)
0 Karma

dcparker
Path Finder

Did you get anywhere with this? I'm starting to explore the same thing. Thanks!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Depending on what you're trying to achieve, your script could call the query through a splunk API such as the REST one.

Alternatively, you could trigger your script from a splunk alert and then pick up the results.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

When you're running the query as an alert already you should look into passing the results to a script called by an alert - http://docs.splunk.com/Documentation/Splunk/5.0.1/alert/ConfiguringScriptedAlerts

0 Karma

xureal
New Member

Thanks for the response. Just had a quick scroll through the REST API, not sure if that's what I'm looking for, however I will have a better read 'morrow when I wake up.

Just to clarify, the search will pick out users that try to ssh into the server from more than one ip address.

So for instance if the user 'andy' tries to ssh in from 192.168.0.2 and 192.168.1.5 the alert will fire off. What I'm trying to do is pass the value of the username, in this case 'andy', to the script, so that I could for example change the motd on the router to something like " Andy tried to login from 2 IPs "

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...