#!/bin/sh
#
# check_splunk - Nagios plugin for checking Splunk server
# Copyright (c) 2005-2006 Splunk, Inc.
#
DEBUG=0
PLUGIN_NAME="check_splunk"
# URL to local Splunk server
# Change this to match the address of your local server. Do NOT include a trailing slash!
SPLUNK_BASEURL="https://mybox:22222"
# Paths to utilities
DEFAULT_PS_COMMAND="/bin/ps"
DEFAULT_NETSTAT_COMMAND="/bin/netstat"
DEFAULT_CAT_COMMAND="/bin/cat"
DEFAULT_GREP_COMMAND="/bin/grep"
DEFAULT_SED_COMMAND="/bin/sed"
DEFAULT_WC_COMMAND="/usr/bin/wc"
DEFAULT_FIND_COMMAND="/usr/bin/find"
DEFAULT_LS_COMMAND="/bin/ls"
DEFAULT_HEAD_COMMAND="/usr/bin/head"
DEFAULT_TAIL_COMMAND="/usr/bin/tail"
DEFAULT_AWK_COMMAND="/usr/bin/awk"
DEFAULT_ECHO_COMMAND="/bin/echo"
# Should we allow potentially unsafe paths to utilities if defaults don't exist?
ALLOW_UNSAFE_PATHS=1
#
# Setup the running environment before we do anything.
#
if [ -z "${SPLUNK_HOME}" ] ; then
SPLUNK_HOME=/opt/splunk
fi
if [ -z "${SPLUNK_DB}" ] ; then
SPLUNK_DB=$SPLUNK_HOME/var/lib/splunk
fi
if [ -z "$PYTHONPATH" ] ; then
PYTHONPATH=$SPLUNK_HOME/lib64/python2.4/site-packages:$SPLUNK_HOME/lib64/python2.4/site-packages/splunk
PYTHONPATH=$SPLUNK_HOME/lib/python2.4/site-packages:$SPLUNK_HOME/lib/python2.4/site-packages/splunk:$PYTHONPATH
else
PYTHONPATH=$SPLUNK_HOME/lib64/python2.4/site-packages:$SPLUNK_HOME/lib64/python2.4/site-packages/splunk:$PYTHONPATH
PYTHONPATH=$SPLUNK_HOME/lib/python2.4/site-packages:$SPLUNK_HOME/lib/python2.4/site-packages/splunk:$PYTHONPATH
fi
if [ -z "$LD_LIBRARY_PATH" ] ; then
if [ "x$ARCH" = "xx86_64" ] ; then
LD_LIBRARY_PATH=$SPLUNK_HOME/lib64:$SPLUNK_HOME/lib
else
LD_LIBRARY_PATH=$SPLUNK_HOME/lib
fi
else
if [ "x$ARCH" = "xx86_64" ] ; then
LD_LIBRARY_PATH=$SPLUNK_HOME/lib64:$SPLUNK_HOME/lib:$LD_LIBRARY_PATH
else
LD_LIBRARY_PATH=$SPLUNK_HOME/lib:$LD_LIBRARY_PATH
fi
fi
export SPLUNK_HOME SPLUNK_DB PATH PYTHONPATH LD_LIBRARY_PATH
#
# Check paths to utilities
#
check_util_paths(){
COMMAND_PATH=""
if [ -f $1 ] ; then
COMMAND_PATH="$1"
fi
# We couldn't find the utility
if [ -z $COMMAND_PATH ] ; then
if [ $ALLOW_UNSAFE_PATHS -eq 1 ] ; then
# Try to find the utility using which
COMMAND_PATH=`which $2`
if [ -z $COMMAND_PATH ] ; then
echo "Cannot find '$2' - aborting..."
exit 3
fi
# If we couldn't find it, back off to no path
# if [ $? != 0 ] ; then
# COMMAND_PATH="$2"
# fi
else
echo "Cannot find '$2' - aborting..."
exit 3
fi
fi
}
check_util_paths $DEFAULT_PS_COMMAND "ps"
PS_COMMAND=$COMMAND_PATH
check_util_paths $DEFAULT_NETSTAT_COMMAND "netstat"
NETSTAT_COMMAND=$COMMAND_PATH
check_util_paths $DEFAULT_CAT_COMMAND "cat"
CAT_COMMAND=$COMMAND_PATH
check_util_paths $DEFAULT_GREP_COMMAND "grep"
GREP_COMMAND=$COMMAND_PATH
check_util_paths $DEFAULT_SED_COMMAND "sed"
SED_COMMAND=$COMMAND_PATH
check_util_paths $DEFAULT_WC_COMMAND "wc"
WC_COMMAND=$COMMAND_PATH
check_util_paths $DEFAULT_FIND_COMMAND "find"
FIND_COMMAND=$COMMAND_PATH
check_util_paths $DEFAULT_LS_COMMAND "ls"
LS_COMMAND=$COMMAND_PATH
check_util_paths $DEFAULT_HEAD_COMMAND "head"
HEAD_COMMAND=$COMMAND_PATH
check_util_paths $DEFAULT_TAIL_COMMAND "tail"
TAIL_COMMAND=$COMMAND_PATH
check_util_paths $DEFAULT_AWK_COMMAND "awk"
AWK_COMMAND=$COMMAND_PATH
check_util_paths $DEFAULT_ECHO_COMMAND "echo"
ECHO_COMMAND=$COMMAND_PATH
[ $DEBUG -eq 1 ] && echo "ps: $PS_COMMAND"
[ $DEBUG -eq 1 ] && echo "netstat: $NETSTAT_COMMAND"
[ $DEBUG -eq 1 ] && echo "cat: $CAT_COMMAND"
[ $DEBUG -eq 1 ] && echo "grep: $GREP_COMMAND"
[ $DEBUG -eq 1 ] && echo "sed: $SED_COMMAND"
[ $DEBUG -eq 1 ] && echo "wc: $WC_COMMAND"
[ $DEBUG -eq 1 ] && echo "find: $FIND_COMMAND"
[ $DEBUG -eq 1 ] && echo "ls: $LS_COMMAND"
[ $DEBUG -eq 1 ] && echo "head: $HEAD_COMMAND"
[ $DEBUG -eq 1 ] && echo "tail: $TAIL_COMMAND"
[ $DEBUG -eq 1 ] && echo "awk: $AWK_COMMAND"
[ $DEBUG -eq 1 ] && echo "echo: $ECHO_COMMAND"
###########################################################
# CHECK THE STATUS OF THE SPLUNK PROCESSES
###########################################################
#
# These don't need to be exported
#
SPLUNKD_PID_FILENAME=${SPLUNK_HOME}/var/run/splunk/splunkd.pid
SPLUNKWEB_PID_FILENAME=${SPLUNK_HOME}/var/run/splunk/splunkweb.pid
SPLUNKD_NAME="splunkd"
SPLUNKWEB_NAME="SplunkWeb"
#
# Check to see whether or not a pidfile is there, then check to see if
# that process id is really running. If it is not, remove the pid file.
# In any case, determine whether or not the process is running.
#
# Returns 0 if the process was not running
# Returns 2 if the pid file was stale
# Returns 1 and sets the variable PID otherwise
#
# usage:
#
# is_pidfile_running /opt/local/var/run/splunk/splunkd.pid
#
is_pidfile_running()
{
PID=""
if [ -f $1 ] ; then
PID=`$CAT_COMMAND $1`
is_procid_running ${PID}
if [ $? -eq 1 ] ; then
#
# the pidfile exists and the process is running
#
return 1
else
#
# the pidfile exists but there is no process running
#
return 0
fi
else
#
# there was no pidfile
#
return 2
fi
}
is_procid_running()
{
$PS_COMMAND -p $1 >/dev/null 2>&1
if [ $? -eq 0 ] ; then
#
# the process is running
#
return 1
else
#
# the process is not running
#
return 0
fi
}
is_proc_running()
{
PROCLINES=`$PS_COMMAND ax | $GREP_COMMAND $1 | $GREP_COMMAND -v grep | $WC_COMMAND -l`
return $PROCLINES
}
check_splunk_procs()
{
SPLUNKD_PROC_STATUS=0
SPLUNKD_PROCID_STATUS=0
SPLUNKWEB_PROC_STATUS=0
SPLUNKWEB_PROCID_STATUS=0
is_proc_running ${SPLUNKD_NAME}
SPLUNKD_PROC_STATUS=$?
is_proc_running ${SPLUNKWEB_NAME}
SPLUNKWEB_PROC_STATUS=$?
is_pidfile_running ${SPLUNKD_PID_FILENAME}
SPLUNKD_PROCID_STATUS=$?
SPLUNKD_PROCID=${PID}
is_pidfile_running ${SPLUNKWEB_PID_FILENAME}
SPLUNKWEB_PROCID_STATUS=$?
SPLUNKWEB_PROCID=${PID}
TMPOUTPUT=""
TMPRETURNCODE=0
case $SPLUNKD_PROC_STATUS in
0)
TMPOUTPUT="${TMPOUTPUT}splunkd is not running"
TMPRETURNCODE=2
;;
*)
TMPOUTPUT="${TMPOUTPUT}splunkd is running"
;;
esac
case $SPLUNKD_PROCID_STATUS in
2)
TMPOUTPUT="${TMPOUTPUT} (pidfile missing)"
TMPRETURNCODE=2
;;
0)
TMPOUTPUT="${TMPOUTPUT} (pidfile stale)"
TMPRETURNCODE=2
;;
1)
TMPOUTPUT="${TMPOUTPUT} (pid=${SPLUNKD_PROCID})"
;;
*)
;;
esac
TMPOUTPUT="${TMPOUTPUT}, "
case $SPLUNKWEB_PROC_STATUS in
0)
TMPOUTPUT="${TMPOUTPUT}splunkWeb is not running"
TMPRETURNCODE=2
;;
*)
TMPOUTPUT="${TMPOUTPUT}splunkWeb is running"
;;
esac
case $SPLUNKWEB_PROCID_STATUS in
2)
TMPOUTPUT="${TMPOUTPUT} (pidfile missing)"
TMPRETURNCODE=2
;;
0)
TMPOUTPUT="${TMPOUTPUT} (pidfile stale)"
TMPRETURNCODE=2
;;
1)
TMPOUTPUT="${TMPOUTPUT} (pid=${SPLUNKWEB_PROCID})"
;;
*)
;;
esac
}
SCRIPT_LOCATION=`dirname "$0"`
SPLUNK_LICENSE_CHECK=$SCRIPT_LOCATION"/getSplunkLicenseInfo.py"
check_splunk_license()
{
TMPOUTPUT=""
TMPRETURNCODE=0
# Default thresholds
USAGE_WARN_LEVEL=80
USAGE_CRIT_LEVEL=90
EXPIRE_WARN_LEVEL=7
EXPIRE_CRIT_LEVEL=2
# Get warning/critical thresholds
while [ 1 ] ; do
if [ "$1" = "-wd" ] ; then
shift 1
if [ $# -eq 0 ] ; then
TMPOUTPUT="Warning expiration threshold missing."
TMPRETURNCODE=2
return 2
else
EXPIRE_WARN_LEVEL=$1;
shift 1
fi
elif [ "$1" = "-cd" ] ; then
shift 1
if [ $# -eq 0 ] ; then
TMPOUTPUT="Critical expiration threshold missing."
TMPRETURNCODE=2
return 2
else
EXPIRE_CRIT_LEVEL=$1
shift 1
fi
elif [ "$1" = "-wu" ] ; then
shift 1
if [ $# -eq 0 ] ; then
TMPOUTPUT="Warning usage threshold missing."
TMPRETURNCODE=2
return 2
else
USAGE_WARN_LEVEL=$1;
shift 1
fi
elif [ "$1" = "-cu" ] ; then
shift 1
if [ $# -eq 0 ] ; then
TMPOUTPUT="Critical usage threshold missing."
TMPRETURNCODE=2
return 2
else
USAGE_CRIT_LEVEL=$1
shift 1
fi
elif [ "$1" = "-s" ] ; then
shift 1
if [ $# -eq 0 ] ; then
TMPOUTPUT="{-s https://server:port} to get Splunk license info is missing."
TMPRETURNCODE=2
return 2
else
LICENSE_SERVER="-s $1"
shift 1
fi
else
break
fi
done
# echo "WD: ${EXPIRE_WARN_LEVEL}"
# echo "CD: ${EXPIRE_CRIT_LEVEL}"
# echo "WU: ${USAGE_WARN_LEVEL}"
# echo "CU: ${USAGE_CRIT_LEVEL}"
# Check if we can get to a workable python
PYTHON=`which python`
if [ ! -x $PYTHON ]
then
echo "Python is missing or not executable"
exit 1
fi
# Check if liscense python script is found
if [ ! -r $SPLUNK_LICENSE_CHECK ]
then
echo "$SPLUNK_LICENSE_CHECK not found"
exit 1
fi
LICENSEOUTPUT=`$PYTHON ${SPLUNK_LICENSE_CHECK} ${LICENSE_SERVER}`
LICENSERESULT=$?
# echo "LICENSE: ${LICENSEOUTPUT}"
# echo "LICENSERESULT: ${LICENSERESULT}"
if [ ! $LICENSERESULT -eq "0" ] ; then
echo "Failed to retrieve license info from the Splunk server ${LICENSEOUTPUT}"
exit 2
else
# Get product version
PRODUCTVERSION=`$ECHO_COMMAND ${LICENSEOUTPUT} | $SED_COMMAND -e 's/.*<product>\([a-z]*\).*<\/product>.*/\1/g'`
TMPOUTPUT="${TMPOUTPUT}Version is $PRODUCTVERSION."
# Get max bytes per day
MAXMBYTESPERDAY=`$ECHO_COMMAND ${LICENSEOUTPUT} | $SED_COMMAND -e 's/.*<byteLimit>\([0-9]*\).*<\/byteLimit>.*/\1/g'`
#echo "MAXMBYTESPERDAY: ${MAXMBYTESPERDAY}"
# Get current byte count
BYTESTODAY=`$ECHO_COMMAND ${LICENSEOUTPUT} | $SED_COMMAND -e 's/.*<currentByteCount>\([0-9]*\).*<\/currentByteCount>.*/\1/g'`
#echo "BYTESTODAY: ${BYTESTODAY}"
MBYTESTODAY=$(( (BYTESTODAY / 1024) ))
#echo "MBYTES: ${MBYTESTODAY}"
if [ $MAXMBYTESPERDAY -eq 0 ]; then
PERCENTUSAGE=0
else
PERCENTUSAGE=`$ECHO_COMMAND "scale=2;($MBYTESTODAY/$MAXMBYTESPERDAY)*100" | bc`
PERCENTUSAGE=`$ECHO_COMMAND $PERCENTUSAGE | $AWK_COMMAND '{split($1,a,".");print a[1];}'`
fi
#echo "PERCENTUSAGE=${PERCENTUSAGE}"
TMPOUTPUT="${TMPOUTPUT} Current license usage = ${MBYTESTODAY}/${MAXMBYTESPERDAY} MB/day (${PERCENTUSAGE}%),"
USAGECODE=0
if [ ${MAXMBYTESPERDAY} -eq 0 ]; then
USAGECODE=0
elif [ ${MBYTESTODAY} -gt ${MAXMBYTESPERDAY} ]; then
USAGECODE=2
else
if [ ${PERCENTUSAGE} -ge ${USAGE_CRIT_LEVEL} ] ; then
USAGECODE=2
elif [ ${PERCENTUSAGE} -ge ${USAGE_WARN_LEVEL} ] ; then
USAGECODE=1
else
USAGECODE=0
fi
fi
# Get expiration date
EXPIRETIME=`$ECHO_COMMAND ${LICENSEOUTPUT} | $SED_COMMAND -e 's/.*<expirationDate>\([0-9]*\).*<\/expirationDate>.*/\1/g'`
EXPIREDATE=`${PYTHON} -c "import datetime; print datetime.datetime.fromtimestamp(${EXPIRETIME}).strftime('%Y-%m-%d')"`
# echo "EXPIRETIME: ${EXPIRETIME}"
# echo "EXPIREDATE: ${EXPIREDATE}"
# Get number of days to expiration
EXPIREDAYS=`$ECHO_COMMAND ${LICENSEOUTPUT} | $SED_COMMAND -e 's/.*<remainingTimeOnLicense>\([0-9]*\).*<\/remainingTimeOnLicense>.*/\1/g'`
EXPIREDAYS=$(( (EXPIREDAYS / 60 / 60 / 24) ))
EXPIRECODE=0
if [ ${EXPIREDAYS} -le 0 ] ; then
TMPOUTPUT="${TMPOUTPUT} License expired on ${EXPIREDATE}!"
EXPIRECODE=2
else
if [ ${EXPIREDAYS} -le ${EXPIRE_CRIT_LEVEL} ] ; then
EXPIRECODE=2
elif [ ${EXPIREDAYS} -le ${EXPIRE_WARN_LEVEL} ] ; then
EXPIRECODE=1
else
EXPIRECODE=0
fi
TMPOUTPUT="${TMPOUTPUT} Expires in ${EXPIREDAYS} days (${EXPIREDATE})."
fi
fi
# Return most critical alert level
if [ ${USAGECODE} -ge ${TMPRETURNCODE} ] ; then
TMPRETURNCODE=${USAGECODE}
fi
if [ ${EXPIRECODE} -ge ${TMPRETURNCODE} ] ; then
TMPRETURNCODE=${EXPIRECODE}
fi
return ${TMPRETURNCODE}
}
###########################################################
# CHECK SPLUNK PORT STATUS
###########################################################
# search for web.conf in both 3.2 and 3.3 locations
for p in etc/system/local etc/system/default etc/bundles/local etc/bundles/default;
do
if [ -f $SPLUNK_HOME/$p/web.conf ]; then
#BUNDLE_CONF=$SPLUNK_HOME/$p/web.conf;
BUNDLE_CONF=/opt/splunk/etc/system/local/web.conf
break;
fi
done
if [ -z $BUNDLE_CONF ]; then
echo "Could not locate web.conf under $SPLUNK_HOME"
exit 1
fi
WEB_PORT=`$CAT_COMMAND $BUNDLE_CONF | $GREP_COMMAND httpport | $AWK_COMMAND '{print $3;}'`
SOAP_PORT1=`$CAT_COMMAND $BUNDLE_CONF | $GREP_COMMAND mgmtHostPort | $AWK_COMMAND '{ split($3, a, ":"); print a[2]; }'`
check_splunk_port_status()
{
NAME=$1
PORT=$2
$NETSTAT_COMMAND -an | $GREP_COMMAND "[:.]$PORT " | $GREP_COMMAND "LISTEN" 2>&1 >/dev/null
if [ $? -eq 0 ]; then
return 0
else
return 1
fi
return 0
}
check_splunk_ports()
{
TMPOUTPUT=""
TMPRETURNCODE=0
check_splunk_port_status "http" "$WEB_PORT"
if [ $? -eq 0 ] ; then
TMPOUTPUT="${TMPOUTPUT}http($WEB_PORT) open"
else
TMPOUTPUT="${TMPOUTPUT}http($WEB_PORT) closed"
TMPRETURNCODE=2
fi
check_splunk_port_status "mgmt" "$SOAP_PORT1"
if [ $? -eq 0 ] ; then
TMPOUTPUT="${TMPOUTPUT}, mgmt($SOAP_PORT1) open"
else
TMPOUTPUT="${TMPOUTPUT}, mgmt($SOAP_PORT1) closed"
TMPRETURNCODE=2
fi
}
###########################################################
# CHECK SPLUNK SEARCH
###########################################################
check_splunk_search()
{
TMPOUTPUT=""
TMPRETURNCODE=0
REVERSE_COMPARE=0
WARN_LEVEL=0
CRIT_LEVEL=0
if [ -f ${SPLUNK_HOME}/bin/splunk ] ; then
# Get warning/critical thresholds
while [ 1 ] ; do
if [ "$1" = "-w" ] ; then
shift 1
if [ $# -eq 0 ] ; then
TMPOUTPUT="Warning threshold missing."
TMPRETURNCODE=2
return 2
else
WARN_LEVEL=$1;
shift 1
fi
elif [ "$1" = "-c" ] ; then
shift 1
if [ $# -eq 0 ] ; then
TMPOUTPUT="Critical threshold missing."
TMPRETURNCODE=2
return 2
else
CRIT_LEVEL=$1
shift 1
fi
elif [ "$1" = "-u" ] ; then
shift 1
if [ $# -eq 0 ] ; then
TMPOUTPUT="User account missing."
TMPRETURNCODE=2
return 2
else
AUTH_USER=$1
shift 1
fi
elif [ "$1" = "-p" ] ; then
shift 1
if [ $# -eq 0 ] ; then
TMPOUTPUT="Password missing."
TMPRETURNCODE=2
return 2
else
AUTH_PASSWD=$1
shift 1
fi
else
break
fi
done
QSTR=$*
if [ -z "$QSTR" ] ; then
TMPOUTPUT="No query string specified."
TMPRETURNCODE=3
return 3
else
URLENCQSTR=`echo $QSTR | $AWK_COMMAND 'BEGIN {
split ("1 2 3 4 5 6 7 8 9 A B C D E F", hextab, " ")
hextab [0] = 0
for ( i=1; i<=255; ++i ) ord [ sprintf ("%c", i) "" ] = i + 0
}
{
encoded = ""
for ( i=1; i<=length ($0); ++i ) {
c = substr ($0, i, 1)
if ( c ~ /[a-zA-Z0-9.-]/ ) {
encoded = encoded c # safe character
} else if ( c == " " ) {
encoded = encoded "%20" # special handling
} else {
# unsafe character, encode it as a two-digit hex-number
lo = ord [c] % 16
hi = int (ord [c] / 16);
encoded = encoded "%" hextab [hi] hextab [lo]
}
}
if ( EncodeEOL ) {
printf ("%s", encoded EOL)
} else {
print encoded
}
}'`
fi
echo "Query String: $QSTR"
echo "Encoded Query String: $URLENCQSTR"
if [ -z $AUTH_USER -a -z $AUTH_PASSWD ]; then
SEARCHRESULTS=`${SPLUNK_HOME}/bin/splunk dispatch "${QSTR} | stats count(_raw)" 2>/dev/null | awk 'NR==3'`
else
SEARCHRESULTS=`${SPLUNK_HOME}/bin/splunk dispatch "${QSTR} | stats count(_raw)" -auth ${AUTH_USER}:${AUTH_PASSWD} 2>/dev/null | awk 'NR==3'`
fi
echo "SEARCHRESULTS: ${SEARCHRESULTS}"
# Check for errors that can occur if the splunk server is down
if [ -z $SEARCHRESULTS ] ; then
TMPOUTPUT="Unable to search Splunk!"
TMPRETURNCODE=2
return 2
fi
SEARCH_URL="${SPLUNK_BASEURL}:${WEB_PORT}/?q=${URLENCQSTR}"
TMPOUTPUT="${SEARCHRESULTS} matching search result(s) found: <a href='${SEARCH_URL}' target='_blank'>Splunk It!</a>"
# Are thresholds reversed
if [ $CRIT_LEVEL -lt $WARN_LEVEL ] ; then
REVERSE_COMPARE=1
fi
# Strip everything sign off of the end of the search result count
SEARCHLINES=${SEARCHRESULTS}
SEARCHLINES=`$ECHO_COMMAND ${SEARCHLINES} | $SED_COMMAND -e 's/\([0-9]*\).*/\1/g'`
# Compare search results with thresholds
if [ $WARN_LEVEL -eq 0 -a $CRIT_LEVEL -eq 0 ] ; then
TMPRETURNCODE=0
elif [ $SEARCHLINES -ge $CRIT_LEVEL -a $REVERSE_COMPARE -eq 0 ] ; then
TMPRETURNCODE=2
elif [ $SEARCHLINES -ge $WARN_LEVEL -a $REVERSE_COMPARE -eq 0 ] ; then
TMPRETURNCODE=1
elif [ $SEARCHLINES -le $CRIT_LEVEL -a $REVERSE_COMPARE -eq 1 ] ; then
TMPRETURNCODE=2
elif [ $SEARCHLINES -le $WARN_LEVEL -a $REVERSE_COMPARE -eq 1 ] ; then
TMPRETURNCODE=1
fi
else
TMPOUTPUT="splunk command was not found."
TMPRETURNCODE=2
fi
return $TMPRETURNCODE
}
# See how we were called.
case "$1" in
search)
check_splunk_search $2 $3 $4 $5 $6 $7 $8 $9 ${10} ${11} ${12} ${13}
echo ${TMPOUTPUT}
exit ${TMPRETURNCODE}
;;
ports)
check_splunk_ports
echo ${TMPOUTPUT}
exit ${TMPRETURNCODE}
;;
procs)
check_splunk_procs
echo ${TMPOUTPUT}
exit ${TMPRETURNCODE}
;;
license)
check_splunk_license $2 $3 $4 $5 $6 $7 $8 $9 ${10} ${11} ${12} ${13}
echo ${TMPOUTPUT}
exit ${TMPRETURNCODE}
;;
*)
echo "No plugin arguments specified."
echo ""
echo "$PLUGIN_NAME - Nagios plugin for Splunk"
echo "Copyright (c) 2005-2006 Splunk, Inc."
echo ""
echo "Usage: $0 {license|ports|procs|search} [options]"
echo ""
echo "license = Checks the status of the Splunk Server license."
echo " This argument accepts optional parameters. Full command usage is shown below:"
echo ""
echo " license [-cd {critval}] [-wd {warnval}] [-cu {critval}] [-wu {warnval}] [-s {url} (http(s)://server:port)]"
echo ""
echo " -cd {critval} = Return a CRITICAL state if the license expires in less than {critval} days."
echo " -wd {warnval} = Return a WARNING state if the license expires in less than {warnval} days."
echo " -cu {critval} = Return a CRITICAL state if the number of daily bytes indexed exceeds"
echo " {critval} percent of license allowance."
echo " -wu {critval} = Return a WARNING state if the number of daily bytes indexed exceeds"
echo " {warnval} percent of license allowance."
echo " -s {url} = Remote Splunk server. Defaults to https://localhost:8089 if not defined"
echo ""
echo "ports = Checks the status of the Splunk Server TCP sockets."
echo ""
echo "procs = Checks the status of the splunkd and splunkWeb processes."
echo ""
echo "search = Checks the Splunk Server for matches to a query."
echo " This argument requires additional parameters. Full command usage is shown below:"
echo ""
echo " search [-c {critval}] [-w {warnval}] [-u {user}] [-p password] {queryString}"
echo ""
echo " -c {critval} = Return a CRITICAL state if number of matches surpasses specified value."
echo " -w {warnval} = Return a WARNING state if number of matches surpasses specified value."
echo " Note: {critval} can be either greater or lesser than {warnval}."
echo " -u {user} = Splunk Enterprise user account"
echo " -p {password} = Password for Splunk Enterprise user's account"
echo " {queryString} = Any valid query string. The results will be piped to count(_raw) to force a return count"
echo ""
exit 3
;;
esac
exit 3