Skip to content

Commit b79f82f

Browse files
michelle0927michelle0927
authored
New Components - splunk (#15966)
* new actions * new components * package.json * pnpm-lock.yaml * use self_signed from $auth * updates * wip * wip * updates
1 parent f62a55f commit b79f82f

File tree

11 files changed

+531
-7
lines changed

11 files changed

+531
-7
lines changed

‎components/splunk/actions/create-event/create-event.mjs‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
import splunk from "../../splunk.app.mjs";
2+
3+
export default {
4+
key: "splunk-create-event",
5+
name: "Create Event",
6+
description: "Sends a new event to a specified Splunk index. [See the documentation](https://docs.splunk.com/Documentation/Splunk/9.4.1/RESTREF/RESTinput#receivers.2Fsimple)",
7+
version: "0.0.1",
8+
type: "action",
9+
props: {
10+
splunk,
11+
indexName: {
12+
propDefinition: [
13+
splunk,
14+
"indexName",
15+
],
16+
},
17+
eventData: {
18+
type: "string",
19+
label: "Event Data",
20+
description: "The data of the event to send to the Splunk index. Raw event text. This is the entirety of the HTTP request body",
21+
},
22+
source: {
23+
type: "string",
24+
label: "Source",
25+
description: "The source value to fill in the metadata for this input's events",
26+
optional: true,
27+
},
28+
sourcetype: {
29+
type: "string",
30+
label: "Sourcetype",
31+
description: "The sourcetype to apply to events from this input",
32+
optional: true,
33+
},
34+
},
35+
async run({ $ }) {
36+
const response = await this.splunk.sendEvent({
37+
$,
38+
params: {
39+
index: this.indexName,
40+
source: this.source,
41+
sourcetype: this.sourcetype,
42+
},
43+
data: this.eventData,
44+
});
45+
$.export("$summary", `Event sent to index ${this.indexName} successfully`);
46+
return response;
47+
},
48+
};

‎components/splunk/actions/get-search-job-status/get-search-job-status.mjs‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
import splunk from "../../splunk.app.mjs";
2+
3+
export default {
4+
key: "splunk-get-search-job-status",
5+
name: "Get Search Job Status",
6+
description: "Retrieve the status of a previously executed Splunk search job. [See the documentation](https://docs.splunk.com/Documentation/Splunk/9.4.1/RESTREF/RESTsearch#search.2Fjobs)",
7+
version: "0.0.1",
8+
type: "action",
9+
props: {
10+
splunk,
11+
jobId: {
12+
propDefinition: [
13+
splunk,
14+
"jobId",
15+
],
16+
},
17+
},
18+
async run({ $ }) {
19+
const response = await this.splunk.getSearchJobStatus({
20+
$,
21+
jobId: this.jobId,
22+
});
23+
$.export("$summary", `Successfully retrieved status for job ID ${this.jobId}`);
24+
return response;
25+
},
26+
};

‎components/splunk/actions/run-search/run-search.mjs‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
import splunk from "../../splunk.app.mjs";
2+
3+
export default {
4+
key: "splunk-run-search",
5+
name: "Run Search",
6+
description: "Executes a Splunk search query and returns the results. [See the documentation](https://docs.splunk.com/Documentation/Splunk/9.4.1/RESTREF/RESTsearch#search.2Fjobs)",
7+
version: "0.0.1",
8+
type: "action",
9+
props: {
10+
splunk,
11+
name: {
12+
propDefinition: [
13+
splunk,
14+
"savedSearchName",
15+
],
16+
},
17+
},
18+
async run({ $ }) {
19+
const response = await this.splunk.executeSearchQuery({
20+
$,
21+
name: this.name,
22+
});
23+
$.export("$summary", `Executed Splunk search: ${this.name}`);
24+
return response;
25+
},
26+
};

‎components/splunk/package.json‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@pipedream/splunk",
3-
"version": "0.0.1",
3+
"version": "0.1.0",
44
"description": "Pipedream Splunk Components",
55
"main": "splunk.app.mjs",
66
"keywords": [
@@ -11,5 +11,10 @@
1111
"author": "Pipedream <[email protected]> (https://pipedream.com/)",
1212
"publishConfig": {
1313
"access": "public"
14+
},
15+
"dependencies": {
16+
"@pipedream/platform": "^3.0.3",
17+
"https": "^1.0.0",
18+
"md5": "^2.3.0"
1419
}
15-
}
20+
}

‎components/splunk/sources/common/base.mjs‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
import splunk from "../../splunk.app.mjs";
2+
import { DEFAULT_POLLING_SOURCE_TIMER_INTERVAL } from "@pipedream/platform";
3+
4+
export default {
5+
props: {
6+
splunk,
7+
timer: {
8+
type: "$.interface.timer",
9+
default: {
10+
intervalSeconds: DEFAULT_POLLING_SOURCE_TIMER_INTERVAL,
11+
},
12+
},
13+
db: "$.service.db",
14+
},
15+
methods: {
16+
async getRecentJobIds() {
17+
const results = this.splunk.paginate({
18+
resourceFn: this.splunk.listJobs,
19+
});
20+
const jobIds = [];
21+
for await (const job of results) {
22+
jobIds.push(job.content.sid);
23+
}
24+
return jobIds;
25+
},
26+
},
27+
};

‎components/splunk/sources/new-alert-fired/new-alert-fired.mjs‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
import splunk from "../../splunk.app.mjs";
2+
import { exec } from "child_process";
3+
import util from "util";
4+
import sampleEmit from "./test-event.mjs";
5+
6+
export default {
7+
key: "splunk-new-alert-fired",
8+
name: "New Alert Fired (Instant)",
9+
description: "Emit new event when a new alert is triggered in Splunk. [See the documentation](https://docs.splunk.com/Documentation/Splunk/9.4.1/RESTREF/RESTsearch#alerts.2Ffired_alerts)",
10+
version: "0.0.1",
11+
type: "source",
12+
dedupe: "unique",
13+
props: {
14+
splunk,
15+
http: "$.interface.http",
16+
db: "$.service.db",
17+
savedSearchName: {
18+
propDefinition: [
19+
splunk,
20+
"savedSearchName",
21+
],
22+
},
23+
},
24+
hooks: {
25+
async activate() {
26+
const response = await this.updateSavedSearch(`-d action.webhook=1 -d action.webhook.param.url="${this.http.endpoint}"`);
27+
if (!response) {
28+
throw new Error("Error creating webhook");
29+
}
30+
},
31+
async deactivate() {
32+
const response = await this.updateSavedSearch("-d action.webhook=0");
33+
if (!response) {
34+
throw new Error("Error disabling webhook");
35+
}
36+
},
37+
},
38+
methods: {
39+
async updateSavedSearch(data) {
40+
const cmd = `curl -X POST ${this.splunk._baseUrl()}/saved/searches/${encodeURIComponent(this.savedSearchName)}?output_mode=json -k -H "Authorization: Bearer ${this.splunk.$auth.api_token}" ${data}`;
41+
const execPromise = util.promisify(exec);
42+
try {
43+
const { stdout } = await execPromise(cmd);
44+
return stdout;
45+
} catch (error) {
46+
console.error("Error:", error.message);
47+
}
48+
},
49+
generateMeta(alert) {
50+
const ts = +alert.result._time;
51+
return {
52+
id: ts,
53+
summary: `New Alert Fired for Source: ${alert.result.source}`,
54+
ts,
55+
};
56+
},
57+
},
58+
async run(event) {
59+
const { body } = event;
60+
if (!body) {
61+
return;
62+
}
63+
64+
const meta = this.generateMeta(body);
65+
this.$emit(body, meta);
66+
},
67+
sampleEmit,
68+
};

‎components/splunk/sources/new-alert-fired/test-event.mjs‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
export default {
2+
"sid": "",
3+
"search_name": "",
4+
"app": "search",
5+
"owner": "",
6+
"results_link": "https://splunk:8000/app/search/search?q=",
7+
"result": {
8+
"_confstr": "source::Source|host::44.210.81.125|webhook",
9+
"_eventtype_color": "",
10+
"_indextime": "1742843623",
11+
"_raw": "{ \"name\": \"test\", \"value\": \"test\" }",
12+
"_serial": "3",
13+
"_si": [
14+
"main"
15+
],
16+
"_sourcetype": "webhook",
17+
"_time": "1742843623",
18+
"eventtype": "",
19+
"host": "44.210.81.125",
20+
"index": "main",
21+
"linecount": "",
22+
"name": "test",
23+
"punct": "{_\"\":_\"_\",_\"\":_\"\"_}",
24+
"source": "Source",
25+
"sourcetype": "webhook",
26+
"splunk_server": "",
27+
"timestamp": "none",
28+
"value": "test"
29+
}
30+
}

‎components/splunk/sources/new-search-event/new-search-event.mjs‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
import common from "../common/base.mjs";
2+
import md5 from "md5";
3+
4+
export default {
5+
...common,
6+
key: "splunk-new-search-event",
7+
name: "New Search Event",
8+
description: "Emit new event when a new search event is created. [See the documentation](https://docs.splunk.com/Documentation/Splunk/9.4.1/RESTREF/RESTsearch#search.2Fv2.2Fjobs.2F.7Bsearch_id.7D.2Fevents)",
9+
version: "0.0.1",
10+
type: "source",
11+
dedupe: "unique",
12+
methods: {
13+
...common.methods,
14+
generateMeta(event) {
15+
return {
16+
id: md5(JSON.stringify(event)),
17+
summary: "New Search Event",
18+
ts: Date.now(),
19+
};
20+
},
21+
},
22+
async run() {
23+
const jobIds = await this.getRecentJobIds();
24+
const events = [];
25+
for (const jobId of jobIds) {
26+
try {
27+
const response = await this.splunk.getSearchEvents({
28+
jobId,
29+
});
30+
if (response?.results?.length) {
31+
events.push(...response.results);
32+
}
33+
} catch {
34+
console.log(`No events found for sid: ${jobId}`);
35+
}
36+
}
37+
events.forEach((event) => {
38+
const meta = this.generateMeta(event);
39+
this.$emit(event, meta);
40+
});
41+
},
42+
};

‎components/splunk/sources/new-search-result/new-search-result.mjs‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
import common from "../common/base.mjs";
2+
3+
export default {
4+
...common,
5+
key: "splunk-new-search-result",
6+
name: "New Search Result",
7+
description: "Emit new events when a search returns results in Splunk. [See the documentation](https://docs.splunk.com/Documentation/Splunk/9.4.1/RESTREF/RESTsearch#saved.2Fsearches)",
8+
version: "0.0.1",
9+
type: "source",
10+
dedupe: "unique",
11+
methods: {
12+
...common.methods,
13+
async getRecentJobs() {
14+
const jobs = [];
15+
const results = this.splunk.paginate({
16+
resourceFn: this.splunk.listJobs,
17+
});
18+
for await (const job of results) {
19+
jobs.push(job);
20+
}
21+
return jobs;
22+
},
23+
generateMeta(result) {
24+
return {
25+
id: result.id,
26+
summary: `New Search with ID: ${result.id}`,
27+
ts: Date.now(),
28+
};
29+
},
30+
},
31+
async run() {
32+
const jobs = await this.getRecentJobs();
33+
for (const job of jobs) {
34+
if (job.content?.resultCount > 0) {
35+
const { results } = await this.splunk.getSearchResults({
36+
jobId: job.content.sid,
37+
});
38+
if (results) {
39+
job.results = results;
40+
}
41+
}
42+
}
43+
jobs.forEach((result) => {
44+
const meta = this.generateMeta(result);
45+
this.$emit(result, meta);
46+
});
47+
},
48+
};

0 commit comments

Comments
 (0)