'Splunk It' Link Not Working in Nagios 4.3.2

Support forum for Nagios Core, Nagios Plugins, NCPA, NRPE, NSCA, NDOUtils and more. Engage with the community of users including those using the open source solutions.
Locked
ssnavely0991
Posts: 2
Joined: Wed Mar 15, 2017 2:43 pm

'Splunk It' Link Not Working in Nagios 4.3.2

Post by ssnavely0991 »

Hello,

I am using the latest version of Nagios (4.3.2). I changed the enable_splunk_integration variable to true today and entered my base url for splunk. However, whenever I would click the 'splunk>' icon from a 'Services' or 'Hosts' page, I would get a 404 not found error. I went to my splunk installation and typed the same search terms in to the splunk search bar that Nagios was trying to pass in the URL. I found that the URL that my version of Splunk (6.5.2) has for searching is different than what is implemented in Nagios 4.3.2.

I went to the Nagios 4.3.2 source code and edited the cgi/cgiutils.c file which contains the anchor tag with href to splunk. I edited the URL to match what is in splunk, recompiled, and now the 'splunk>' button works great.

Has anyone else had this issue with Nagios / Splunk integration? Anyways here is the .patch file for the changes I made.

Code: Select all

--- nagios-4.3.2/cgi/cgiutils.c 2017-05-09 12:03:31.000000000 -0500
+++ nagios-4.3.2-splunk-patch/cgi/cgiutils.c    2017-07-07 14:44:20.759764576 -0500
@@ -2063,7 +2063,7 @@
        if(hst == NULL)
                return;

-       printf("<a href='%s?q=search %s' target='_blank'><img src='%s%s' alt='Splunk It' title='Splunk It' border='0'></a>\n", splunk_url, url_encode(hst->name), url_images_path, SPLUNK_SMALL_WHITE_ICON);
+       printf("<a href='%sapp/search/search?q=search %s' target='_blank'><img src='%s%s' alt='Splunk It' title='Splunk It' border='0'></a>\n", splunk_url, url_encode(hst->name), url_images_path, SPLUNK_SMALL_WHITE_ICON);

        return;
        }
@@ -2077,7 +2077,7 @@
        if(svc == NULL)
                return;

-       printf("<a href='%s?q=search %s%%20", splunk_url, url_encode(svc->host_name));
+       printf("<a href='%sapp/search/search?q=search %s%%20", splunk_url, url_encode(svc->host_name));
        printf("%s' target='_blank'><img src='%s%s' alt='Splunk It' title='Splunk It' border='0'></a>\n", url_encode(svc->description), url_images_path, SPLUNK_SMALL_WHITE_ICON);

        return;
@@ -2098,7 +2098,7 @@

        strip_splunk_query_terms(newbuf);

-       printf("<a href='%s?q=search %s' target='_blank'>", splunk_url, url_encode(newbuf));
+       printf("<a href='%sapp/search/search?q=search %s' target='_blank'>", splunk_url, url_encode(newbuf));
        if(icon > 0)
                printf("<img src='%s%s' alt='Splunk It' title='Splunk It' border='0'>", url_images_path, (icon == 1) ? SPLUNK_SMALL_WHITE_ICON : SPLUNK_SMALL_BLACK_ICON);
        printf("</a>\n");

tmcdonald
Posts: 9117
Joined: Mon Sep 23, 2013 8:40 am

Re: 'Splunk It' Link Not Working in Nagios 4.3.2

Post by tmcdonald »

I don't think we have actively maintained the Splunk integration in quite some time. I honestly thought it had been deprecated.
Former Nagios employee
ssnavely0991
Posts: 2
Joined: Wed Mar 15, 2017 2:43 pm

Re: 'Splunk It' Link Not Working in Nagios 4.3.2

Post by ssnavely0991 »

Are you planning on maintaining splunk integration in the future? We would like to use it at my company. In the past we have had to go to our Splunk instance and manually search for these terms. Because Nagios is our starting point when we have a problem with a host/service, it is much nicer to simply click a button and be taken to splunk with some relevant search terms. It looks like a simple URL change fixes the integration.
tmcdonald
Posts: 9117
Joined: Mon Sep 23, 2013 8:40 am

Re: 'Splunk It' Link Not Working in Nagios 4.3.2

Post by tmcdonald »

Almost certainly not, as we have our own Nagios Log Server product that we maintain: https://www.nagios.com/products/nagios-log-server/
Former Nagios employee
Locked