Last active
July 21, 2018 05:34
-
-
Save korteke/922da5fed003996445863d331feabdb2 to your computer and use it in GitHub Desktop.
Splunk - Restore from archive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/python | |
| import os | |
| import time | |
| import datetime | |
| from subprocess import call | |
| # VARIABLES | |
| archivepath = '/archive/' | |
| logpath = '/logdata/' | |
| splunkbin = '/opt/splunk/bin/' | |
| debug = 1 | |
| # /VARIABLES | |
| # Check that we are in screen | |
| if os.environ.get('STY') is not None: | |
| if debug: | |
| print '[+] Screen detected. We are good to go' | |
| pass | |
| else: | |
| print '[-] Run this script in screen, because it might take long time and your SSH session will terminate' | |
| exit(1) | |
| index = raw_input('Enter index:').rstrip('\n') | |
| if debug: | |
| print 'Index : ' + index | |
| frozenpath = archivepath + index + '/' | |
| if debug: | |
| print 'Frozenpath : ' + frozenpath | |
| thawedpath = logpath + index + '/thaweddb/' | |
| if debug: | |
| print 'Thawedpath : ' + thawedpath | |
| d1 = raw_input('Enter start date: (eg. 01.08.2017): ') | |
| d2 = raw_input('Enter end date: (eg. 31.12.2017): ') | |
| if debug: | |
| print 'Date1 and Date2 : ' + d1 + ' ' + d2 | |
| print '[+] Searching dates on index ' + index | |
| print 'in ' + frozenpath | |
| try: | |
| frozen_list = os.listdir(frozenpath) | |
| except: | |
| print "[-] Unable to walk index directory, check if path exists : " + archivepath + index | |
| exit(1) | |
| if debug: | |
| print 'Frozen List ' + str(len(frozen_list)) | |
| try: | |
| start_date = int(time.mktime(time.strptime(d1 + " 00:00:00", "%d.%m.%Y %H:%M:%S"))); | |
| except: | |
| print "[-] Incorrect date inserted" | |
| exit(1) | |
| try: | |
| end_date = int(time.mktime(time.strptime(d2 + " 00:00:00", "%d.%m.%Y %H:%M:%S"))); | |
| except: | |
| print "[-] Incorrect date inserted" | |
| exit(1) | |
| print "Start Date epoch: " + str(start_date) | |
| print "End Date epoch: " + str(end_date) | |
| print "Got " + str(len(frozen_list)) + " elements from " + frozenpath | |
| restore_list = [] | |
| for line in frozen_list: | |
| tmp = line.split('_') | |
| t1 = int(tmp[2]) | |
| t2 = int(tmp[1]) | |
| t11 = datetime.datetime.fromtimestamp(t1).strftime('%d-%m-%Y %H:%M:%S') | |
| t22 = datetime.datetime.fromtimestamp(t2).strftime('%d-%m-%Y %H:%M:%S') | |
| if ( (start_date >= t1 and end_date >= t2 and start_date <= t1 ) or ( start_date >= t1 and end_date <= t2) or ( start_date <= t1 and end_date >= t2) or ( start_date <= t1 and end_date <= t2 and end_date >= t1)): | |
| print "Added line -- " + line + " -- t1 : " + str(t1) + " " + "t2 : " + str(t2) + " - " + t11 + " " + t22 | |
| restore_list.append(line) | |
| if len(restore_list) == 0: | |
| print 'List empty, nothing found..' | |
| exit(1) | |
| # Calculate size | |
| restoreSize = len(restore_list)*128 | |
| print "[+] Found " + str(len(restore_list)) + " files. Total restore size " + str(restoreSize) + " MB" | |
| print "[+] Copying databases into thaweddb.." | |
| for db in restore_list: | |
| if debug: | |
| print "Executing: " + "cp -R " + frozenpath + db + " " + thawedpath | |
| call("cp -R " + frozenpath + db + " " + thawedpath,shell = True) | |
| print "[+] Rebuilding DBs" | |
| for db in restore_list: | |
| if debug: | |
| print "Executing: " + splunkbin + "splunk rebuild +thawedpath + db" | |
| #call(splunkbin + "splunk rebuild " + thawedpath + db,shell = True) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment