使用來自 ansible playbook 的查詢過濾 Splunk 響應

Question

目前，我們在部署期間手動監控 splunk 儀表板。 我們想自動化這個。 為此，我們想提出一個帶有 splunk 查詢的 ansible playbook。 該劇本將在部署期間運行。

我能夠成功連接到 splunk，但我無法使搜索查詢正常工作

####
# type: task
#
# vars:
#   5xxcheck_output(str,command): raw output from command
#   5xxcheck_response(str,command): raw output to json
#
# desc:
# uses splunk to get 5xxcheck

---
- name: Tasks to query splunk
  hosts: localhost
  connection: local
  tasks:
    - name: get search_id for 5xx check from splunk
      uri:
        url: https://<splunk_instance>/services/search/jobs
        follow_redirects: all
        method: POST
        user: xxxxxx
        password: xxxxxxx
        force_basic_auth: yes
        body: "search host=tc1* ResponseCode=500 earliest=-15m"
        body_format: raw
        validate_certs: no
        status_code: 201
        return_content: true
      register: search_id
    - debug: msg="{{ search_id.status }}"

    - name: use the search_id to get the 5xx check results
      uri:
        url: https://<splunk_instance>/services/search/jobs/{{ search_id }}/results/
        method: GET
        user: xxxxxx
        password: xxxxxxx
        force_basic_auth: yes
        body_format: raw
        return_content: true
      register: 5xxcheck_output
      until: 5xxcheck_output.status > 0 and 5xxcheck_output.status != 500

    - name: Put results into 5xxcheck_response
      set_fact:
        5xxcheck_response: "{{ 5xxcheck_output.json }}"

    - name: Print 5xxcheck_response if -v
      debug:
        var: 5xxcheck_response
        verbosity: 1

我想使用 uri 模塊來參數化 splunk 搜索。 我能夠從終端執行以下 2 個步驟，以獲得響應

Step1：獲取SID（搜索ID）

curl -u  user:pwd -k https://<splunk-instance>/services/search/jobs -d search="search host=t1* ResponseCode=200 earliest=-15m"

<?xml version="1.0" encoding="UTF-8"?>
<response>
  <sid>1604947864.xxxxxx</sid>
</response>

Step2：使用SID獲取響應

curl -u user:pwd -k https://<splunk-instance>/services/search/jobs/<SID>/results/ --get -d output_mode=raw

Answer 1

---
- name: Tasks to query splunk
  hosts: localhost
  connection: local
  tasks:
    - name: get search_id for 5xx check from splunk
      uri:
        url: https://splunk_instance/services/search/jobs/
        follow_redirects: all
        method: POST
        user: xxxxx
        password: xxxxx
        force_basic_auth: yes
        body_format: form-urlencoded
        status_code: [200, 201, 202]
        body:
          - [ search, "search host=t1* ResponseCode=500 earliest=-15m" ]
          - [ output_mode, "json" ]
        validate_certs: no
        return_content: true
      register: search_id
    - debug: msg="{{ search_id }}"

這對我有用。 現在，當我運行這個劇本時，我得到了有效的 sid 作為響應。