rkondracki / splunk-elasticsearch

A search command for Splunk which will allow you to search Elastic Search and display the results in the Splunk GUI

splunk-elasticsearch

I have created a search command for Splunk which will allow you to search Elastic Search and display the results in the Splunk GUI

This project is now a valid splunk application and installs as you would any other splunk applications Steps
Install python if it is not installed

Install ElasticSearch https://github.com/elasticsearch/elasticsearch-py
"pip install elasticsearch "

This project is now a Splunk Application so just copy the splunk-elasticsearch directory to your splunk $SPLUNK_HOME/etc/apps directory and should work

====================================================== git clone "This Project"
rsync -av splunk-elasticsearch $SPLUNK_HOME/etc/apps

Now you should be able to do a simple search like
| esearch | top message

or
| esearch oldest=now-100d earliest=now query="some text" index=nagios* limit=1000 field=message

================================================
command reference:
esearch
oldest = default (now-1d) uses elasticsearch timedate value or function
earliest = default (now) uses elasticsearch timedate value or function
index = default () sepecify the elasticsearch index to search
limit = default (50) number of records to return
field = default ("message") which elasticsearch field to query and return the value
query = default ("" | might change this to match_all) the elasticsearch query_string