Last active
March 27, 2020 18:50
-
-
Save pmeyerson/395ddf9db4beb717928eeef828404328 to your computer and use it in GitHub Desktop.
simple HEC example
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/usr/python3 | |
| import time | |
| import random | |
| import string | |
| import sys | |
| from splunk_http_event_collector import http_event_collector | |
| # splunk_http_event_collector available from https://pypi.org/project/Splunk-HEC/ | |
| def getThing(foo): | |
| ''' return action value ''' | |
| if foo == "action": | |
| options = ['Looked at a thing', 'Fixed a thing', 'Broke a thing', 'Turned a thing on', 'Turned a thing off'] | |
| elif foo == "color": | |
| options = ['red', 'blue', 'green', 'yello'] | |
| elif foo == "status": | |
| options = ['good', 'good', 'good', 'good', 'bad'] | |
| return random.choices(options)[0] | |
| def generate_payload(sessionId, payload): | |
| event = {} | |
| action = getThing("action") | |
| color = getThing("color") | |
| event.update({"msg": "trying stuff", "severity": "DEBUG", "action": action, "color": color, | |
| "sessionId":sessionId}) | |
| payload = update_payload(payload, event) | |
| return payload | |
| def update_payload(payload, event): | |
| payload.update({"time": time.time(), "event": event}) | |
| return payload | |
| def main(): | |
| ''' log stuff via hec | |
| ''' | |
| ## Update with your token generated from Splunk, and splunk server localhost or 0.0.0.0 typically works for docker, depending on platform. | |
| key = "XXXXX" | |
| host = "localhost" | |
| hec = http_event_collector(key, host) | |
| print("starting") | |
| while True: | |
| if not hec.check_connectivity(): | |
| print("hec connectivity failed") | |
| sys.exit(1) | |
| time.sleep(random.uniform(0.5, 5)) | |
| sessionId = ''.join(random.choices(string.ascii_uppercase + string.digits, k=7)) | |
| payload = {"time": time.time(), | |
| "source": "localhost", | |
| "sourcetype" : "devtalk"} | |
| event = {"sessionId": sessionId, "msg":"Starting to do stuff", "severity":"INFO"} | |
| payload.update({"event": event}) | |
| hec.sendEvent(payload) | |
| for i in range(random.randint(1,5)): | |
| payload = generate_payload(sessionId, payload) | |
| hec.sendEvent(payload) | |
| time.sleep(random.uniform(1,6)) | |
| event.update({"msg": "All Finished with the things", "severity": "INFO"}) | |
| payload = update_payload(payload, event) | |
| hec.sendEvent(payload) | |
| if __name__ == "__main__": | |
| main() |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment