使用来自 ansible playbook 的查询过滤 Splunk 响应

Question

目前，我们在部署期间手动监控 splunk 仪表板。 我们想自动化这个。 为此，我们想提出一个带有 splunk 查询的 ansible playbook。 该剧本将在部署期间运行。

我能够成功连接到 splunk，但我无法使搜索查询正常工作

####
# type: task
#
# vars:
#   5xxcheck_output(str,command): raw output from command
#   5xxcheck_response(str,command): raw output to json
#
# desc:
# uses splunk to get 5xxcheck

---
- name: Tasks to query splunk
  hosts: localhost
  connection: local
  tasks:
    - name: get search_id for 5xx check from splunk
      uri:
        url: https://<splunk_instance>/services/search/jobs
        follow_redirects: all
        method: POST
        user: xxxxxx
        password: xxxxxxx
        force_basic_auth: yes
        body: "search host=tc1* ResponseCode=500 earliest=-15m"
        body_format: raw
        validate_certs: no
        status_code: 201
        return_content: true
      register: search_id
    - debug: msg="{{ search_id.status }}"

    - name: use the search_id to get the 5xx check results
      uri:
        url: https://<splunk_instance>/services/search/jobs/{{ search_id }}/results/
        method: GET
        user: xxxxxx
        password: xxxxxxx
        force_basic_auth: yes
        body_format: raw
        return_content: true
      register: 5xxcheck_output
      until: 5xxcheck_output.status > 0 and 5xxcheck_output.status != 500

    - name: Put results into 5xxcheck_response
      set_fact:
        5xxcheck_response: "{{ 5xxcheck_output.json }}"

    - name: Print 5xxcheck_response if -v
      debug:
        var: 5xxcheck_response
        verbosity: 1

我想使用 uri 模块来参数化 splunk 搜索。 我能够从终端执行以下 2 个步骤，以获得响应

Step1：获取SID（搜索ID）

curl -u  user:pwd -k https://<splunk-instance>/services/search/jobs -d search="search host=t1* ResponseCode=200 earliest=-15m"

<?xml version="1.0" encoding="UTF-8"?>
<response>
  <sid>1604947864.xxxxxx</sid>
</response>

Step2：使用SID获取响应

curl -u user:pwd -k https://<splunk-instance>/services/search/jobs/<SID>/results/ --get -d output_mode=raw

Answer 1

---
- name: Tasks to query splunk
  hosts: localhost
  connection: local
  tasks:
    - name: get search_id for 5xx check from splunk
      uri:
        url: https://splunk_instance/services/search/jobs/
        follow_redirects: all
        method: POST
        user: xxxxx
        password: xxxxx
        force_basic_auth: yes
        body_format: form-urlencoded
        status_code: [200, 201, 202]
        body:
          - [ search, "search host=t1* ResponseCode=500 earliest=-15m" ]
          - [ output_mode, "json" ]
        validate_certs: no
        return_content: true
      register: search_id
    - debug: msg="{{ search_id }}"

这对我有用。 现在，当我运行这个剧本时，我得到了有效的 sid 作为响应。