icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Forwarder toolbox - TA-forwarderquery
SHA256 checksum (forwarder-toolbox-ta-forwarderquery_07.tgz) 923b1c3c79ec7fa2b2829c6e310637cd10fc767fc0167071242ec0290b99eb3b SHA256 checksum (forwarder-toolbox-ta-forwarderquery_06.tgz) 27f395cec031701c26b7eaff332ca5c08d6b57a0e3bd18d79244c0eb39aa35b6 SHA256 checksum (forwarder-toolbox-ta-forwarderquery_05.tgz) 70906ff22dfe5ab8462e741bb57cff68e3e1db0feed3881a13baed5593bc7061 SHA256 checksum (forwarder-toolbox-ta-forwarderquery_04.tgz) 33419711640d621b4a5ba82ff05e52acd8874cf9970211f2e4c199c02045a33a SHA256 checksum (forwarder-toolbox-ta-forwarderquery_03.tgz) 8a77e42a4d6c8e7a3184560da8033a853dca3c2826d6420ff74ee5011f570fe5 SHA256 checksum (forwarder-toolbox-ta-forwarderquery_02.tgz) 1e4805c34834f8085eeea17cabc51fa95dd0ff97573e836386fa290b55951d22 SHA256 checksum (forwarder-toolbox-ta-forwarderquery_01.tgz) e40af88d69d0f32b1044aef38b48546f4eb7d03ba1532302f42c8f3769318e89
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Forwarder toolbox - TA-forwarderquery

Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
Custom command to query a forwarder via its rest endpoint.

Ever wanted to easily inspect the settings on your forwarders like which indexers receive the data, what apps are installed and which inputs do they provide? Even if you are not able to connect yourself to the machine because you are not admin of the Linux, Windows etc Servers?
This TA provides you with the means to specify the user and password for the forwarder REST access and allows you to do just that. Plus it comes with a nice Dashboard to browse through your forwarders.

Alas the built in | rest command will not allow you to connect to a forwarder so this is effectively a workaround.

See also http://answers.splunk.com/answers/229173/forwarder-rest-api-how-can-i-get-the-list-of-files.html for the rationale.

Usually you would install it on the deployment server and have a firewall rule to open port 8089 on all forwarders etc from this server.

You need to create a forwarderquery.conf in /local with this structure as minimum:

[default]
user=admin
password=yourfunnypassword
port=8089

Also you need to have set a password on the forwarders or configured them to accept login even though the admin password was never change etc.

For a breakdown of what changes see the changelog below.

Feel free to reach me at curious.sle@gmail.com

Version: 0.1
Version 0.1, works so far... Simple command to query the forwarder on its rest service port 8089 Please copy the forwarderquery.conf from default to local and modify to your needs. Samples: ################## # TA-forwarderquery ################## [forwarderquery-command] syntax = |forwarderquery server="xyz" api="/services/..." stanza="default" description = this command will contact the forwarder rest port and get the xml presented in a field xmlresults usage = public example1 = |forwarderquery server="xyz" api="/services/data/outputs/tcp/server" stanza="default"| spath input=xmlresults| fields - xmlresults| fields feed.entry.title | rename feed.entry.title AS indexershortdesc = query the nimbus webservice interface comment1 = get the forwarder example2 = |forwarderquery server="xyz" api="/servicesNS/nobody" stanza="default" | spath input=xmlresults | rename feed.entry.title AS title | table title | mvexpand title | rename title AS app comment2 = get the installed apps example3 = |forwarderquery server="xyz" api="/servicesNS/nobody/search/data/inputs/monitor/" | spath input=xmlresults | rename feed.entry.id AS id | rename feed.entry.title AS title | rename feed.entry.updated AS updated | eval tmp=mvzip(title,id) | table tmp | mvexpand tmp | eval tmp=split(tmp,",")| eval file=mvindex(tmp,0) | eval id=mvindex(tmp,1) | search id="search" | table file comment3 = get the locally added monitored files related = tags =

New in Version 0.2:
port is now taken from the forwarderquery.conf, alternatively user port="xyz" to override
new parameter method, defaults to GET, can set it to method="POST" in order to perform stuff like a restart
updated dashboard now shows the deploy-poll server(s)
pending: the xml output should be passed in _raw not xmlresults for ease of use.

New in Version 0.3:
Add a file via oneshot

New in Version 0.4:
contains a new command to perform rest calls on a list of hosts. Also allows to post data and can also call a DELETE action for eliminating endpoint configs. New UI for checking the connection to forwarders via REST, check the deploy-poll settings and - whee! - a browser for the remote filesystem.

New features in v0.5:
Forwarder host resource inspector dashboard
Overview of forwarder resources

New features in v.06:
remote rest explorer
remote filesystem explorer - depends on https://splunkbase.splunk.com/app/3118/ for vis

New features in v0.7:
TailingProcessor FileStatus dashboard (under tools)

(!) Note: this needs the forwarder introspection to be enabled as described in https://answers.splunk.com/answers/191486/how-to-collect-introspection-logs-from-forwarders.html

Release Notes

Version 0.7
Oct. 30, 2017

New dashboard "TailingProcessor FileStatus"

Version 0.6
Sept. 23, 2017

Version 0.6 - now has improved remote rest and remote filesystem explorer. Dependency is https://splunkbase.splunk.com/app/3118/ for the remote filesystem explorer though.
Work in progress, new outpumode json2 - fairly full parsed output. For backwards compatibility this is not default and json will de deprecated.

Version 0.5
Dec. 9, 2016

New features in v0.5:
Forwarder host resource inspector dashboard
Overview of forwarder resources

Note: this needs the forwarder introspection to be enabled as described in https://answers.splunk.com/answers/191486/how-to-collect-introspection-logs-from-forwarders.html

Version 0.4
Nov. 3, 2016

Version 0.4 contains a new command to perform rest calls on a list of hosts. Also allows to post data and can also call a DELETE action for eliminating endpoint configs.

New UI for checking the connection to forwarders via REST, check the deploy-poll settings and - whee! - a browser for the remote filesystem.

Version 0.3
Aug. 15, 2016

New: pass post parameters like this
data="{¨property':'one','secondproperty':'two'}"

example:
|forwarderquery server="myhost" api="/services/data/inputs/oneshot" stanza="default" method="POST" data="{'name':'/full/path/file.name,'index':'main','sourcetype':'funkysourcetype'}"

Version 0.2
July 14, 2015

Version 0.2
Whats new:
* port is now taken from the forwarderquery.conf, alternatively user port="xyz" to override
* new parameter method, defaults to GET, can set it to method="POST" in order to perform stuff like a restart
* updated dashboard now shows the deploy-poll server(s)

pending: the xml output should be passed in _raw not xmlresults for ease of use.

Version 0.1
June 22, 2015

Version 0.1, works so far...
Simple command to query the forwarder on its rest service port 8089

Please copy the forwarderquery.conf from default to local and modify to your needs.

Samples:
##################
# TA-forwarderquery
##################
[forwarderquery-command]
syntax = |forwarderquery server="xyz" api="/services/..." stanza="default"
description = this command will contact the forwarder rest port and get the xml presented in a field xmlresults
usage = public
example1 = |forwarderquery server="xyz" api="/services/data/outputs/tcp/server" stanza="default"| spath input=xmlresults| fields - xmlresults| fields feed.entry.title | rename feed.entry.title AS indexershortdesc = query the nimbus webservice interface
comment1 = get the forwarder
example2 = |forwarderquery server="xyz" api="/servicesNS/nobody" stanza="default" | spath input=xmlresults | rename feed.entry.title AS title | table title | mvexpand title | rename title AS app
comment2 = get the installed apps
example3 = |forwarderquery server="xyz" api="/servicesNS/nobody/search/data/inputs/monitor/" | spath input=xmlresults | rename feed.entry.id AS id | rename feed.entry.title AS title | rename feed.entry.updated AS updated | eval tmp=mvzip(title,id) | table tmp | mvexpand tmp | eval tmp=split(tmp,",")| eval file=mvindex(tmp,0) | eval id=mvindex(tmp,1) | search id="*search*" | table file
comment3 = get the locally added monitored files
related =
tags =

68
Installs
909
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2019 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.