Goal of this is to have powershell search my AD Domain and find all machines with the splunk forwarder installed. Then validate if the machine host name matches the server name located in the server.conf file. Once it does not match, output those machines and the value that is has. Next step is to rename the line of where the server = $HOSTNAME$ is changed to be correct, then restart the splunk service on those machines.
Anyone have something like this? So far i was able to come up with this script from combined AI generators and other sources.*
# Define the path to server.conf file relative to the $SPLUNK_HOME directory
$serverConfPath = "$env:SPLUNK_HOMEetcsystemlocalserver.conf"
# Get the local computer name
$computerName = $env:COMPUTERNAME
# Define a variable to hold the result
$result = $null
# Check if the server.conf file exists
if (Test-Path $serverConfPath) {
# Read the server.conf file
$serverConf = Get-Content $serverConfPath
# Find the line that contains "serverName"
$serverNameLine = $serverConf | Select-String -Pattern "serverNames*=s*(.+)"
if ($serverNameLine) {
# Extract the serverName value
$serverName = $serverNameLine.Matches[0].Groups[1].Value.Trim()
# Compare the serverName to the actual computer name
if ($serverName -ne $computerName) {
# Store the result if the serverName does not match
$result = [PSCustomObject]@{
ComputerName = $computerName
ServerName = $serverName
}
} else {
Write-Host "serverName matches the computer name."
}
} else {
Write-Host "serverName not found in $serverConfPath"
}
} else {
Write-Host "server.conf not found at $serverConfPath"
}
# Output the result if there was a mismatch
if ($result) {
$result | Format-Table -AutoSize
}
So far, I havent tested this script but if there is already a working solution it would be great to know what it is.
Lee Hart is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.