Skip to content

Commit 3df524a

Browse files
codingWithJimmycodingWithJimmy
committed
Multiple updates
- Adjusted the date format in all Powershell scripts to include timezone offset - Added more logic to dsRemove.ps1 to account for existing configurations on the host and removing all configurations at once - Added a bailout if inputs.conf configurations are not present for dsReplace scripts - Created inputs.conf.spec file to include new settings for correcting deployment server configurations
1 parent 390b525 commit 3df524a

File tree

8 files changed

+85
-24
lines changed

8 files changed

+85
-24
lines changed

‎README/inputs.conf.spec

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
## Configurations to pass btool checks without throwing errors
2+
3+
[script:<uniqueName>]
4+
deploymentServerUri = [string]
5+
* Correct URI that should be configured
6+
7+
deploymentClientApp = [string]
8+
* App name that contains the correct deploymentclient.conf configuration
9+
10+
[powershell:<uniqueName>]
11+
deploymentServerUri = [string]
12+
* Correct URI that should be configured with port
13+
14+
deploymentClientApp = [string]
15+
* App name that contains the correct deploymentclient.conf configuration

‎bin/dateTimeCorrect.ps1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ $referenceDateTime = "$SPLUNKHOME\apps\SplunkForwarderRepairKit\datetime.xml"
44
$restartDateTimeCheck = "$SPLUNKHOME\etc\restartdatetime.txt"
55

66
### Filter to attach timestamps where necessary
7-
filter timestamp {"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss.fff') ${env:COMPUTERNAME}: $_"}
7+
filter timestamp {"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss.fff zzz') ${env:COMPUTERNAME}: $_"}
88

99
### Check flags and take appropriate actions for host name
1010
if(Compare-Object -ReferenceObject $(Get-Content $existingDateTime) -DifferenceObject $(Get-Content $referenceDateTime)) {

‎bin/dsRemove.ps1

Lines changed: 49 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,57 @@
1+
### Grab variables from inputs.conf
2+
$BTOOL_INPUT = & $SPLUNKHOME\bin\splunk.exe cmd btool inputs list powershell://dsRemove --debug
3+
$SFRK_APP = ($BTOOL_INPUT -replace [regex]::Escape("$SPLUNKHOME\etc\apps\"),"" -replace "\\(default|local)\\inputs.conf","").Split(" ")[0]
4+
$CORRECT_DS_LINE = ($BTOOL_INPUT | findstr deploymentServerUri)
5+
$CORRECT_DS_APP_LINE = ($BTOOL_INPUT | findstr deploymentClientApp)
6+
$CORRECT_DS = ("$CORRECT_DS_LINE" -replace [regex]::Escape("$SPLUNKHOME\etc\apps\"),"").Split(" ")[3]
7+
$CORRECT_DS_APP = ("$CORRECT_DS_APP_LINE" -replace [regex]::Escape("$SPLUNKHOME\etc\apps\"),"").Split(" ")[3]
8+
9+
if (!$CORRECT_DS) {
10+
Write-output "deploymentServerUri not configured in inputs.conf" | timestamp
11+
exit
12+
}
13+
14+
if (!$CORRECT_DS_APP) {
15+
Write-output "deploymentClientApp not configured in inputs.conf" | timestamp
16+
exit
17+
}
18+
119
### Configure file paths for the system
2-
$LOCAL = {$((Get-ChildItem -Path "$SPLUNKHOME\etc\system\local" -Include deploymentclient.conf -File -Recurse).Count)}
3-
$DEPLOYED = {$((Get-ChildItem -Path "$SPLUNKHOME\etc\apps" -Include deploymentclient.conf -File -Recurse).Count)}
20+
$LOCAL = $((Get-ChildItem -Path "$SPLUNKHOME\etc\system\local" -Include deploymentclient.conf -File -Recurse).Count)
21+
$DEPLOYED = $((Get-ChildItem -Path "$SPLUNKHOME\etc\apps" -Include deploymentclient.conf -File -Recurse).Count)
22+
$LIST_APPS = $(Get-ChildItem -Path "$SPLUNKHOME\etc\apps" -Include deploymentclient.conf -File -Recurse)
23+
$BAD_APPS = @(($LIST_APPS -replace "(deafult|local)\\deploymentclient.conf","").where{$_ -notmatch [regex]::Escape("$CORRECT_DS_APP") })
424
$RESTART_CHECK = "$SPLUNKHOME\etc\restartds.txt"
525

626
### Filter to attach timestamps where necessary
7-
filter timestamp {"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss.fff') ${env:COMPUTERNAME}: $_"}
27+
filter timestamp {"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss.fff zzz') ${env:COMPUTERNAME}: $_"}
28+
29+
## Capture the current configuration that Splunk is using from btool
30+
$BTOOL = & $SPLUNKHOME\bin\splunk.exe cmd btool deploymentclient list --debug | FINDSTR 'targetUri'
31+
$CURRENT_DS = ($BTOOL -replace [regex]::Escape("$SPLUNKHOME"),"").Split(" ")[3]
32+
$CURRENT_APP_PATH = "$SPLUNKHOME"+($BTOOL -replace [regex]::Escape("$SPLUNKHOME"),"" -replace "\\(deafult|local)\\deploymentclient.conf","").Split(" ")[0]
33+
$CURRENT_APP_NAME = ($CURRENT_APP_PATH -replace [regex]::Escape("$SPLUNKHOME\etc\apps\"),"")
834

935
### Check to see if there is a deploymentclient.conf file under $SPLUNKHOME\etc\apps and bail out if there isn't
1036
if ($DEPLOYED -eq "0") {
11-
Write-output "No deploymentclient.conf detected in $SPLUNKHOME\etc\apps. Bailing out so the fowarder doesn't get orphaned." | timestamp
12-
} elseif ($DEPLOYED -gt "1") {
13-
Write-output "Multiple deploymentclient.conf detected in $SPLUNKHOME\etc\apps. Check all deployed apps to ensure you\'re only using one." | timestamp
14-
} elseif ($LOCAL -eq "1" -AND $DEPLOYED -eq "1") {
15-
### Remove the local "deploymentclient.conf" and flag
16-
Write-output "Removed deploymentclient.conf from local system." | timestamp
17-
Remove-Item -Path "$LOCAL"
18-
Out-File -FilePath "$RESTART_CHECK"
19-
} else {
20-
Write-output "No deploymentclient.conf correction necessary." | timestamp
37+
Write-output "No deploymentclient.conf detected in $SPLUNKHOME\etc\apps. Bailing out so the fowarder doesn't get orphaned." | timestamp
38+
Write-output "Deploy $CORRECT_APP to this server to correct this issue." | timestamp
39+
}
40+
elseif ($DEPLOYED -gt "1") {
41+
Write-output "Multiple deploymentclient.conf detected in $SPLUNKHOME\etc\apps." | timestamp
42+
Write-output "Removing bad app(s) to ensure there is no contention with $CORRECT_DS_APP" | timestamp
43+
foreach ($item in $BAD_APPS)
44+
{
45+
Remove-Item -Path "$item" -Force -Recurse -Confirm
46+
Write-output "Removed app: $item" | timestamp
47+
}
48+
Out-File -FilePath "$RESTART_CHECK"
49+
}
50+
elseif ($LOCAL -eq "1" -AND $DEPLOYED -eq "1") {
51+
Write-output "Removed deploymentclient.conf from local system." | timestamp
52+
Remove-Item -Path "$LOCAL" -Force -Confirm
53+
Out-File -FilePath "$RESTART_CHECK"
54+
}
55+
else {
56+
Write-output "No deploymentclient.conf correction necessary." | timestamp
2157
}

‎bin/dsRemove.sh

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,33 +6,41 @@
66
### Look for a deploymentclient.conf file in the apps directory and define the path to the restartds.txt file
77
CORRECT_APP_DEPLOYED=$(find $SPLUNK_HOME/etc/apps -type d -name ${CORRECT_APP} | wc -l)
88
DEPLOYED_APP=$(find $SPLUNK_HOME/etc/apps -type f -name deploymentclient.conf | wc -l)
9+
BAD_APPS=($(find $SPLUNK_HOME/etc/apps -type f -name deploymentclient.conf | grep -v ${CORRECT_APP} | sed "s/\/(default|local)\/deploymentclient.conf//"))
910
LOCAL=$(find $SPLUNK_HOME/etc/system/local -type f -name deploymentclient.conf | wc -l)
1011
RESTART_CHECK=$SPLUNK_HOME/etc/restartds.txt
1112

1213
## Capture the current deployment server URI from btool
1314
BTOOL=$(${SPLUNK_HOME}/bin/splunk btool deploymentclient list --debug | grep targetUri)
1415
CURRENT_DS=$(echo ${BTOOL} | awk '{print $4}')
15-
CURRENT_APP_PATH=$(echo ${BTOOL} | awk '{print $1}' | sed "s/\/(default|local)\/deploymentclient.conf//"
16+
CURRENT_APP_PATH=$(echo ${BTOOL} | awk '{print $1}' | sed "s/\/(default|local)\/deploymentclient.conf//")
1617
CURRENT_APP_NAME=$(echo ${CURRENT_APP_PATH} | sed "s|${SPLUNK_HOME}\/etc\/apps\/||")
1718

19+
## Check for inputs configurations and bail out if they don't exist
20+
if [ -z "${CORRECT_DS}" ] || [ -z "${CORRECT_APP}" ]; then
21+
echo "$(date -R) $HOSTNAME: Missing configurations in inputs.conf."
22+
exit 1
23+
fi
24+
1825
## If there is no deployed app with a deployment client, bail out
1926
if [ $DEPLOYED_APP = "0" ]; then
2027
echo "$(date -R) $HOSTNAME: No deploymentclient.conf detected in $SPLUNK_HOME/etc/apps. Bailing out so the fowarder doesn\'t get orphaned."
21-
echo "$(date -R) $HOSTNAME: Deploy \"${CURRENT_APP_NAME}\" to this server to correct this issue."
28+
echo "$(date -R) $HOSTNAME: Deploy \"${CORRECT_APP}\" to this server to correct this issue."
2229
exit 1
2330
fi
2431

2532
## If more than one deploymentclient.conf file is deployed, nuke the wrong app and set the checkpoint file
2633
if [ $DEPLOYED_APP > "1" ]; then
2734
echo "$(date -R) $HOSTNAME: Multiple apps with deploymentclient.conf detected in $SPLUNK_HOME/etc/apps."
28-
echo "$(date -R) $HOSTNAME: Removing ${CURRENT_APP_NAME} to ensure there is no contention with ${CORRECT_APP}"
29-
rm -rf "${CURRENT_APP_PATH}"
35+
echo "$(date -R) $HOSTNAME: Removing bad apps to ensure there is no contention with \"${CORRECT_APP}\""
36+
for i in "${BAD_APPS[@]}"; do
37+
rm -rf $i
38+
done
3039
touch $RESTART_CHECK
3140
fi
3241

3342
## If there's 1 local config, remove the local one and set the checkpoint file
3443
if [ $LOCAL = "1" ]; then
35-
# Remove the deploymentclient.conf from $SPLUNK_HOME/etc/system/local
3644
rm -f $SPLUNK_HOME/etc/system/local/deploymentclient.conf > /dev/null 2>&1
3745
echo $(date -R) $HOSTNAME: Removed deploymentclient.conf from local system.
3846
touch $RESTART_CHECK

‎bin/hostCorrect.ps1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ $restartInputCheck = "$SPLUNKHOME\etc\restartinput.txt"
66
$restartServerCheck = "$SPLUNKHOME\etc\restartserver.txt"
77

88
### Filter to attach timestamps where necessary
9-
filter timestamp {"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss.fff') ${env:COMPUTERNAME}: $_"}
9+
filter timestamp {"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss.fff zzz') ${env:COMPUTERNAME}: $_"}
1010

1111
### Compare values to actual host value and flag accordingly
1212
if (-not ($currentHost -eq $env:COMPUTERNAME)){

‎bin/regenGUID.ps1

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ $INSTANCE_CHECK = {$(Test-Path "$INSTANCE_FILE.*")}
44
$RESTART_CHECK = "$SPLUNKHOME\etc\restartguid.txt"
55

66
### Filter to attach timestamps where necessary
7-
filter timestamp {"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss.fff') ${env:COMPUTERNAME}: $_"}
7+
filter timestamp {"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss.fff zzz') ${env:COMPUTERNAME}: $_"}
88

99
### Check to see if the GUID has already been replaced on this host previously by this script
1010
if ($INSTANCE_CHECK -eq "True") {
@@ -15,4 +15,4 @@ if ($INSTANCE_CHECK -eq "True") {
1515
Copy-Item -Path "$INSTANCE_FILE" -Destination "$INSTANCE_FILE.$(Get-Date -Format 'MMddyyyy').bak"
1616
Remove-Item -Path "$INSTANCE_FILE"
1717
Out-File -FilePath "$RESTART_CHECK"
18-
}
18+
}

‎bin/restart.ps1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ $restartGUID = $(Test-Path "$SPLUNKHOME\etc\restartguid.txt" -PathType Leaf)
1111
$restartDateTime = $(Test-Path "$SPLUNKHOME\etc\restartdatetime.txt" -PathType Leaf)
1212

1313
### Filter to attach timestamps where necessary
14-
filter timestamp {"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss.fff') ${env:COMPUTERNAME}: $_"}
14+
filter timestamp {"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss.fff zzz') ${env:COMPUTERNAME}: $_"}
1515

1616
if ($restartInput -eq "True" -OR $restartServer -eq "True" -OR $restartDS -eq "True" -OR $restartGUID -eq "True" -OR $restartDateTime -eq "True") {
1717
Write-output "One or more settings has been changed." | timestamp

‎default/inputs.conf

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,14 +52,16 @@ sourcetype = ds_remove:output
5252
interval = -1
5353
source = ds_remove_output
5454
deploymentServerUri =
55-
deploymentClientApp =
55+
deploymentClientApp =
5656

5757
[powershell://dsRemove]
5858
disabled = 1
5959
index = _internal
6060
sourcetype = ds_remove:output
6161
source = ds_remove_output
6262
script = . "$SplunkHome\etc\apps\SplunkForwarderRepairKit\bin\dsRemove.ps1"
63+
deploymentServerUri =
64+
deploymentClientApp =
6365

6466
### Scripts used to correct issues with datetime.xml
6567
### https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020

0 commit comments

Comments
 (0)