Deployment Architecture

Is it possible to tell if users are online before reboot?

nick405060
Motivator

Is it possible to query for online users via CLI, not through SPL? I reboot frequently and want my reboot shell script to say "WARNING: (1) users are online. Are you sure you want to reboot?"

Currently I go run a SPL search every time I reboot to make sure nobody is online, which is a huge pain

Or am limited to doing this with Python SDK?

0 Karma
1 Solution

martynoconnor
Communicator

martynoconnor
Communicator

You can search from the CLI, but you'll still have to use SPL:

https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchReference/CLIsearchsyntax

nick405060
Motivator

Thanks. I should have clarified, I am fine doing it through SPL, I just didn't want to do it through the search UI.

I didn't use the Python SDK to do write this, just did it in normal Python (my bash scripting isn't quite up to par to do this in bash):

import os

query = os.popen('/opt/splunk/bin/splunk search "search earliest=-3m latest=now \`users_online\`"').read()

if "--------" in query:
        print "CAUTION: Users are online. Perform manual reboot."
else:
        print "Users are not online. Rebooting"
        os.system("/opt/splunk/bin/splunk stop -f && /opt/splunk/bin/splunk start")
0 Karma

nick405060
Motivator

Macro:

(index=_internal sourcetype=splunkd_ui_access uri_path="/en-US/app*") OR (index=_audit AND action="login attempt" OR (search!="" search_id!="'scheduler*"  search_id!="scheduler*" search_id!="'subsearch*")) user!="splunk-system-user" user!="n/a" user!="ME" user!=testuser* user!="-" | eval sortable_time=_time | eval time=strftime(sortable_time,"%Y-%m-%d %H:%M:%S") |
streamstats count as temp_count | stats values(*) as * by temp_count | fields - temp_count | sort 0 sortable_time | dedup user | table user
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...