Splunk dashboard - scheduled export and storage solution

Hi, its been quite some time from last blog. I've decided to help you in addressing a potential need of having scheduled splunk dashboard exports as well as storing them on a remote storage - mounted via CIFS.

What do I mean by this?

Say you have a dashboard on which you preview and manage custom alerts, reports, whatever - you have bunch of data that comes in and is processed in real time, but you have a need of storing that dashboards state every day in specific time, 365 days a year, for either audit or procedural needs...

Here is a custom solution I came up with and it might just fit your needs.

1 - Create a shared folder on remote windows server

Just jump on your storage server, create a network share folder with write permissions given to an account you are going to use for authentication to that share, lets call it "smbMountServiceAcc", and obviously a read permissions to groups/users that will have a need to look at those reports.

2 - Create .smbcreds file

We are about to mount that created shared folder from our splunk or any other linux system, and we'll have to authenticate to that share, so we are going to store our credentials inside .smbcreds file. Make sure to chown to root:root and chmod to 400, so only root will have rights to read this file, which is just as secure and as needed as we (and /etc/fstab) needs it.

username=smbMountServiceAcc
password=awesomePass
domain=yourDomain

3 - Mount that shared folder from linux server

We are now ready to make a persistent mount from linux side. Place following inside /etc/fstab

//127.0.0.1/SharedFolders/Splunk\040Exports/ /opt/splunkexports cifs uid=linuxUser,credentials=/home/splunkUser/.smbcreds 0 0

4 - Create .cust_env file

Just like in case of .smbcreds and any other sensitive information containing files, don't make it over permissive..

export ReportExporter=SplunkAuthPass

5 - Setup python request script that will fetch and generate pdf

#!/usr/bin/python
import requests
import datetime
import os

now0 = datetime.datetime.now()
now1 = now0.strftime("%Y-%d-%m_%H-%M-%S")
secret = os.environ.get('ReportExporter')

report_timestamp = ("/opt/splunkexports/daily_" + now1 + ".pdf")

# Your splunk dashboard name
params = {
    'input-dashboard': 'dailyMonitors',
}

# hit that undocumented /services/pdfgen/render endpoint
response = requests.post(
    'https://your-splunk-instance.tld:8089/services/pdfgen/render',
    auth=('your-splunk-username', secret),
    verify=False,
    params=params,
)

# Maybe play with some error handling if you have to ensure continuity
if response.status_code == 200:
    with open(report_timestamp, 'wb') as pdffile:
        pdffile.write(response.content)

6 - Create a cronjob that will execute this python daily

00 07 * * * . /home/splunkUser/.cust_env; /usr/bin/python /home/splunkUser/pdfgenerator.py

Whooh, there you go.

I sincerely am pleased if this helped you, or maybe even gave you an idea of making your or probably someones else life easier.

Till the next one,
Cheers,
bigfella