Using Splunk with Casper
Casper reports are great, but I soon realized are too much work to run, open in excel and make pretty graphs that management could understand. With that said I decided to implement splunk. I am by no means a splunk expert but with basic knowledge it was quite simple.
First off splunk is free, download it. http://www.splunk.com/download. My company was already utilizing splunk but I decided to implement my own server for testing reasons.
After splunk was implemented I read up a little and found that splunk has a mysql connector which is great since Casper uses MYSQL. Since I wanted splink to talk to Casper I would need to install the splunk mysqlconnector, which can be found here http://splunk-base.splunk.com/apps/36664/splunk-mysql-connector
Now for the Casper part, since you will reading the raw JSS MYSQL database, you will need to first create a read only mysql account so that it can access to the JSS database. You can run a google search to figure that out.
I used Mysql workbench to test my queries, but you can use any visual mysql query tool you like.
After I confirmed my mysql read-only account worked and was successfully pulling data from the JSS database with my queries I went back to splunk.
For my situation I already had smart groups that were giving me the data, and the data that management wanted, so all I had to do is query mysql for the smart groups I had already created and then tell splunk how and where to display the data. Below is the splunk search I used via the splunk mysql connector.
| mysqlquery spec=Casper_Splunk query="select cg.computer_group_name, count(c.computer_id)
from computer_groups cg
inner join computer_group_memberships cgm
on cg.computer_group_id = cgm.computer_group_id
inner join computers c
on cgm.computer_id = c.computer_id
where cg.is_smart_group = 1
and computer_group_name = 'Encrypted Macs';" | gauge count(c.computer_id) 1 10 20 30 40 50 60 70 80 90 100 200 300The above search basically query’s the JSS for a specific smart group, in this case my Encrypted macs smart group, and then reports back the number of machines in that group, pretty simply right. But splunk offers very cool ways of displaying data, so what I did is appended a radial guage to the search so that it displays a graphical speedometer like reading. I have this search saved, and in splunk I have created a custom view attached to this search. Below is the xml for the custom view.
<view template="dashboard.html">
<module name="HiddenSavedSearch" autoRun="True" layoutPanel="panel_row1_col1">
<param name="savedSearch">Encrypted Macs Progress</param>
<module name="JobProgressIndicator">
<module name="HiddenChartFormatter">
<param name="chart">radialGauge</param>
<param name="chartTitle">Encrypted Macs Progress (RealTime)</param>
<module name="JobProgressIndicator"/>
<module name="FlashChart">
</module>
</module>
</module>
</module>
</view>I also modified the setting on the saved search to update in splunk every minute, that way the data would always be up-to-date when viewed.
One difficulty I ran into was that the custom view that I created could only be viewed in splunk, which didn’t make sense because the whole point of creating this was for management to view data, not for them to log into another system that they were unfamiliar with, etc etc.
So I followed the below splunk article for Enabling insecure login so that I could have someone view the page without logging into splunk. http://docs.splunk.com/Documentation/Splunk/5.0.2/AdvancedDev/3rdParty
The only issue is that the password to the insecure login is passed in clear text, I’ve yet to investigate this but if anyone has a better solution please share.
Once I setup insecure logon, I basically grabbed the URL of the splunk graph which in my case was: http://myserver-01.mycompany.net:8000/account/insecurelogin?username=admin&password=admin&return_to=%2Fen-US%2Fapp%2FMySQL%2FEncrypted_Macs_Progress
And just attatched it to an iframe in sharepoint.
That’s it have fun.