You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
45 lines
1.5 KiB
45 lines
1.5 KiB
#
|
|
# Executes bucket copying on peers/indexers
|
|
#
|
|
|
|
import sys, json
|
|
import vixutils_duplicate as vixutils
|
|
import splunk.Intersplunk as isp
|
|
from builtins import map
|
|
if sys.version_info >= (3, 0):
|
|
from splunk.vix import erp_launcher
|
|
else:
|
|
import erp_launcher_duplicate as erp_launcher
|
|
|
|
def splitCommaList(commaSeparatedList):
|
|
return map(lambda x: x.strip(), commaSeparatedList.split(','))
|
|
|
|
def keepRollingIndexes(indexes, vixes):
|
|
indexesToKeep = set([])
|
|
rollKey = 'output.buckets.from.indexes'
|
|
for vixMap in vixes:
|
|
if rollKey in vixMap and vixMap[rollKey]:
|
|
indexesToKeep.update(set(splitCommaList(vixMap[rollKey])))
|
|
|
|
return {k : v for k, v in indexes.items() if k in indexesToKeep}
|
|
|
|
def getProvidersAndVixesFromStdIn():
|
|
# Ghetto parsing since splunk's parsing doesn't care about quote escaping
|
|
# Only works when there's one and only one argument.
|
|
jsonStr = sys.argv[1:][0].split("=",1)[1]
|
|
if jsonStr == None:
|
|
raise Exception("Missing required json blob in arguments " + str(sys.argv))
|
|
jzon = json.loads(jsonStr)
|
|
return (jzon['providers'], jzon['vixes'])
|
|
|
|
|
|
if __name__ == '__main__':
|
|
providers, vixes = getProvidersAndVixesFromStdIn()
|
|
|
|
results,dummyresults,settings = isp.getOrganizedResults()
|
|
sessionKey = settings.get("sessionKey")
|
|
if sessionKey == None:
|
|
vixutils.generateErrorResults("username/password authorization not given to 'input'.")
|
|
else:
|
|
erp_launcher.launchSplunkMRForIndexes(sessionKey, 'roll', 'splunk_archiver.log', providers, vixes, keepRollingIndexes)
|