Batch file to send Splunk Alerts

The free version of Splunk lacks the capability to do scheduled reports and alerting. However, it has a very capable API that can be simply accessed using curl. I wrote some batch files to access these APIs and scheduled them to run periodically. One grabs the last alerts off of the IDS and the other alerts on Hard Drive Errors.

@echo off
set tdate=%date:/=-%
set tdate=%tdate: =%
set ttime=%time::=_%
set ttime=%ttime: =T%
set ttime=%ttime:.=-%

call :doit IDSmalware5m
call :doit DiskErrors5m

goto :EOF

curl -s -k https://splunkserver:8089/services/search/jobs -d"search=| savedsearch %1"|grep sid |sed "s///g"| sed "s///g" > %temp%\splunk-alert-%1-%tdate%%ttime%.txt
for /f %%i in (%temp%\splunk-alert-%1-%tdate%%ttime%.txt) do call :loop %%i
goto :EOF

::echo "%1"
curl -s -k https://splunkserver:8089/services/search/jobs/%1|grep "1" > nul
if errorlevel 1 sleep 2 && goto :loop
curl -s -k h"ttps://splunkserver:8089/services/search/jobs/%1/results?output_mode=csv"
goto :EOF
This entry was posted in Uncategorized. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s