Skip to content

Upgrade to version 2.0.0 #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
codingWithJimmy merged 1 commit into from
Mar 24, 2022
Merged

Upgrade to version 2.0.0 #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,15 +138,19 @@ This app contains scripts for Windows and Linux forwarders that will move the ex
Windows - `regenGUID.ps1`\
\*Nix - `regenGUID.sh`

###### Install updated datetime.xml file
A notice was sent out in November of 2019 that stated there was an issue with the datetime.xml that would affect data ingested due to a misconfigured datetime.xml. The bug and fix can be read about here: https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020
###### Install updated datetime.xml file (REMOVED)
The scripts that performed this action have been retired. This method is also not the safest method to update this file and should not be used. It is preferable to simply upgrade Splunk version (Splunk Enterprise or Splunk Universal Forwarder) that already has this fix in place.

This app contains scripts for Windows and Linux forwarders that will back up the existing "datetime.xml" to replace with the corrected version contained within the app.
https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020#Upgrade_Splunk_platform_instances_to_a_version_with_an_updated_version_of_datetime.xml

**NOTE: This should only be used on Universal Forwarders. Please see the above documentation link for instructions for other Splunk instances.**
~~A notice was sent out in November of 2019 that stated there was an issue with the datetime.xml that would affect data ingested due to a misconfigured datetime.xml. The bug and fix can be read about here: https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020~~

Windows - `dateTimeCorrect.ps1`\
\*Nix - `dateTimeCorrect.sh`
~~This app contains scripts for Windows and Linux forwarders that will back up the existing "datetime.xml" to replace with the corrected version contained within the app.~~

~~**NOTE: This should only be used on Universal Forwarders. Please see the above documentation link for instructions for other Splunk instances.**~~

~~Windows - `dateTimeCorrect.ps1`\
\*Nix - `dateTimeCorrect.sh`~~

###### Update default 'changeme' password on Splunk Forwarders (primary installations before 7.1.0)
Forwarders deployed before version 7.1.0 didn't require the admin password be changed upon installation. Starting at 7.1.0, the forwarders required either a user-seed file or manual input of the password during first-time run. While the REST API of the forwarder is not configured to allow POST requests until the password is changed on versions prior to 7.1.0, changing the password is still recommended.
Expand Down
17 changes: 0 additions & 17 deletions bin/dateTimeCorrect.ps1
View file
Open in desktop

This file was deleted.

16 changes: 0 additions & 16 deletions bin/dateTimeCorrect.sh
View file
Open in desktop

This file was deleted.

7 changes: 1 addition & 6 deletions bin/restart.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,17 +3,15 @@ $inputPath = "$SPLUNKHOME\etc\restartinput.txt"
$serverPath = "$SPLUNKHOME\etc\restartserver.txt"
$dsPath = "$SPLUNKHOME\etc\restartds.txt"
$guidPath = "$SPLUNKHOME\etc\restartguid.txt"
$dateTimePath = "$SPLUNKHOME\etc\restartdatetime.txt"
$restartInput = $(Test-Path "$SPLUNKHOME\etc\restartinput.txt" -PathType Leaf)
$restartServer = $(Test-Path "$SPLUNKHOME\etc\restartserver.txt" -PathType Leaf)
$restartDS = $(Test-Path "$SPLUNKHOME\etc\restartds.txt" -PathType Leaf)
$restartGUID = $(Test-Path "$SPLUNKHOME\etc\restartguid.txt" -PathType Leaf)
$restartDateTime = $(Test-Path "$SPLUNKHOME\etc\restartdatetime.txt" -PathType Leaf)

### Filter to attach timestamps where necessary
filter timestamp {"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss.fff zzz') ${env:COMPUTERNAME}: $_"}

if ($restartInput -eq "True" -OR $restartServer -eq "True" -OR $restartDS -eq "True" -OR $restartGUID -eq "True" -OR $restartDateTime -eq "True") {
if ($restartInput -eq "True" -OR $restartServer -eq "True" -OR $restartDS -eq "True" -OR $restartGUID -eq "True") {
Write-output "One or more settings has been changed." | timestamp
Write-output "Restarting forwarder." | timestamp
if ($restartInput -eq "True") {
Expand All @@ -28,9 +26,6 @@ if ($restartInput -eq "True" -OR $restartServer -eq "True" -OR $restartDS -eq "T
if ($restartGUID -eq "True") {
Remove-Item -path "$guidPath"
}
if ($restartDateTime -eq "True") {
Remove-Item -path "$dateTimePath"
}
Remove-Item -path "$PSScriptRoot\DeleteMeToRestart"
} else {
Write-output "No settings have been changed." | timestamp
Expand Down
6 changes: 1 addition & 5 deletions bin/restart.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,9 @@ RESTARTINPUT="$SPLUNK_HOME/etc/restartinput.txt"
RESTARTSERVER="$SPLUNK_HOME/etc/restartserver.txt"
RESTARTDS="$SPLUNK_HOME/etc/restartds.txt"
RESTARTGUID="$SPLUNK_HOME/etc/restartguid.txt"
RESTARTDATETIME="$SPLUNK_HOME/etc/restartdatetime.txt"

### If any files exist, restart forwarder
if [ -f "$RESTARTINPUT" ] || [ -f "$RESTARTSERVER" ] || [ -f "$RESTARTDS" ] || [ -f "$RESTARTGUID" ] || [ -f "$RESTARTDATETIME" ]; then
if [ -f "$RESTARTINPUT" ] || [ -f "$RESTARTSERVER" ] || [ -f "$RESTARTDS" ] || [ -f "$RESTARTGUID" ]; then
echo "$(date -R) ${HOSTNAME}: One or more settings has been changed."
echo "$(date -R) ${HOSTNAME}: Restarting forwarder."
if [ -f "$RESTARTINPUT" ]; then
Expand All @@ -25,9 +24,6 @@ if [ -f "$RESTARTINPUT" ] || [ -f "$RESTARTSERVER" ] || [ -f "$RESTARTDS" ] || [
if [ -f "$RESTARTGUID" ]; then
rm -f "$RESTARTGUID"
fi
if [ -f "$RESTARTDATETIME" ]; then
rm -f "$RESTARTDATETIME"
fi
rm -f "${APP_PATH}/bin/DeleteMeToRestart"
else
echo "$(date -R) ${HOSTNAME}: No settings have been changed."
Expand Down
225 changes: 0 additions & 225 deletions datetime.xml
View file
Open in desktop

This file was deleted.

3 changes: 3 additions & 0 deletions default/app.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,6 @@ check_for_updates = false
[ui]
is_visible = false
is_manageable = false

[launcher]
version = 2.0.0
18 changes: 1 addition & 17 deletions default/inputs.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,23 +61,7 @@ sourcetype = ds_remove:output
source = ds_remove_output
script = . "$SplunkHome\etc\apps\SplunkForwarderRepairKit\bin\dsRemove.ps1"
deploymentServerUri =
deploymentClientApp =

### Scripts used to correct issues with datetime.xml
### https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020
[script://./bin/dateTimeCorrect.sh]
disabled = 1
index = _internal
sourcetype = datetime_correct:output
interval = -1
source = datetime_correct_output

[powershell://dateTimeCorrect]
disabled = 1
index = _internal
sourcetype = datetime_correct:output
source = datetime_correct_output
script = . "$SplunkHome\etc\apps\SplunkForwarderRepairKit\bin\dateTimeCorrect.ps1"
deploymentClientApp =

### Admin password change scripts
[script://./bin/pwchange.sh]
Expand Down
2 changes: 0 additions & 2 deletions default/limits.conf
View file
Open in desktop

This file was deleted.