UMN-SplunkRA.psm1

###
# Copyright 2017 University of Minnesota, Office of Information Technology

# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.

# You should have received a copy of the GNU General Public License
# along with Foobar.  If not, see <http://www.gnu.org/licenses/>.

# based off http://dev.splunk.com/restapi  


#region Connect-Splunk
Function Connect-Splunk{
    <#
        .SYNOPSIS
            Connect to splunk server and header properly formatted
        
        .DESCRIPTION
            Connect to splunk server and header properly formatted
        
        .PARAMETER splunkCreds
            PS credential of user that has access

        .PARAMETER server
            FQDN for splunk server

        .PARAMETER SkipCertificateCheck
            Ignore bad SSL Certificates

        .PARAMETER port
            splunk server port to connect to, port 8089 is the default

        .EXAMPLE
            $header = Connect-Splunk -splunkCreds $cred -SkipCertificateCheck -server 'splunk.mydomain.com'

        .OUTPUTS
            System.Collections.Hashtable[]
            Header with Authentication information

        .NOTES
            # http://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing#Authentication_and_authorization
            For legacy automation systems dealing with cookies - 
            -UseBasicParsing is included on the InvokeWebRequest - needed parsing for Orchestrator
    #>

    [CmdletBinding()]
    param(

        [ValidateNotNullOrEmpty()]
        [System.Management.Automation.PSCredential]$splunkCreds,

        [parameter(Mandatory)]
        [string]$server,

        [switch]$SkipCertificateCheck,

        [string]$port = "8089"
    )
     
    Begin
    {
        if ($SkipCertificateCheck -and $PSVersionTable.PSVersion.Major -lt 6)
        {
            [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
add-type @"
    using System.Net;
    using System.Security.Cryptography.X509Certificates;
    public class TrustAllCertsPolicy : ICertificatePolicy {
        public bool CheckValidationResult(
            ServicePoint srvPoint, X509Certificate certificate,
            WebRequest request, int certificateProblem) {
            return true;
        }
    }
"@
            [System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
        }
}
    Process
    {    
        $uri = "https://$server`:$port/services/auth/login"
        $return = (Invoke-RestMethod -Uri $uri -UseBasicParsing -body "username=$($splunkCreds.UserName);password=$($splunkCreds.GetNetworkCredential().Password)" -Method Post -ContentType 'application/x-www-form-urlencoded').response
        $session = $return.sessionKey
        return (@{"Authorization"= "Splunk $session"})
    }
    End{}
}
#endregion

#region Invoke-SplunkBase
Function Invoke-SplunkBase{
    <#
        .SYNOPSIS
            Base function all other functions are built on

        .DESCRIPTION
            Base function all other functions are built on

        .PARAMETER header
            Header value (use Connect-splunk to get it)

        .PARAMETER server
            FQDN for splunk server

        .PARAMETER outPutmode
            csv,xml,json data return type for call

        .PARAMETER port
            splunk server port to connect to, port 8089 is the default

        .PARAMETER resourcePath
            Api resoure path.
        
        .PARAMETER resultSize
            Limit the number of results to return.  100 is the default.  Use zero to get all

        .EXAMPLE    

        .NOTES	    
    #>

    [CmdletBinding()]
    param(

        [parameter(Mandatory)]
        [string]$server,

        [parameter(Mandatory)]
        [System.Collections.Hashtable]$header,

        [System.Collections.Hashtable]$body,

        [parameter(Mandatory)]
        [string]$resourcePath,

        ## Warning the convertfrom-json blows up a LOT, it does not like the way spunk sends back data
        [ValidateSet("json", "csv", "xml", "default")]
        [string]$outPutmode = "default",

        #[switch]$SkipCertificateCheck,

        [string]$port = "8089",

        [string]$resultSize
    )
    Begin{}
    Process
    {
        $uri = "https://$server`:$port/services/$resourcePath"
        if ($outPutmode -ne 'default'){$uri += "?output_mode=$outPutmode"}
        if ($resultSize)
        {
            if ($outPutmode -ne 'default'){$uri += "&count=$resultSize"}
            else {$uri += "?count=$resultSize"} 
        }
        if ($body){$data = (Invoke-WebRequest -Uri $uri -Headers $header -Body $body -UseBasicParsing ).Content}
        else{$data = (Invoke-WebRequest -Uri $uri -Headers $header -UseBasicParsing ).Content}
        if ($outPutmode -eq 'csv'){ return ($data | ConvertFrom-Csv)}
        elseif ($outPutmode -eq 'json'){return ($data | ConvertFrom-Json)}
        else{return $data}
    }
    End{}
}
#endregion

#region Get-SplunkSearchExport
Function Get-SplunkSearchExport{
    <#
        .SYNOPSIS
            Get results for a search

        .DESCRIPTION
            Get results for a search	

        .PARAMETER header
            Header value (use Connect-splunk to get it)

        .PARAMETER server
            FQDN for splunk server

        .PARAMETER outPutmode
            csv,xml,json data return type for call

        .PARAMETER port
            splunk server port to connect to, port 8089 is the default

        .PARAMETER search
            Realtime Search you want performed

    #>

    [CmdletBinding()]
    param(

        [parameter(Mandatory)]
        [string]$server,

        [parameter(Mandatory)]
        [System.Collections.Hashtable]$header,

        [parameter(Mandatory)]
        [string]$search,

        ## Warning the convertfrom-json blows up a LOT, it does not like the way spunk sends back data
        [ValidateSet("json", "csv", "xml", "default")]
        [string]$outPutmode = "default",

        #[switch]$SkipCertificateCheck,

        [string]$port = "8089"
    )
    
    Begin{}
    Process
    {
        $body = @{"search" = "search $search"}
        return (Invoke-SplunkBase -server $server -header $header -resourcePath 'search/jobs/export' -outPutmode $outPutmode -body $body -port $port)
    }
    End{}
}
#endregion

#region Get-SplunkListSavedSearches
function Get-SplunkListSavedSearches{
<#
    .SYNOPSIS
	    Get list of saved searches

    .DESCRIPTION
        Get list of saved searches	

    .PARAMETER header
        Header value (use Connect-splunk to get it)

    .PARAMETER server
        FQDN for splunk server

    .PARAMETER port
        splunk server port to connect to, port 8089 is the default

    .PARAMETER complete
       The default is to return a summary of search, use this switch to get all the details the system returns

    .EXAMPLE
	    Get-SplunkListSavedSearches -server $server -header $header

    .NOTES
	    
#>
    [CmdletBinding()]
    Param
    (
        [parameter(Mandatory)]
        [string]$server,

        [parameter(Mandatory)]
        [System.Collections.Hashtable]$header,

        [string]$port = "8089",

        [switch]$complete
    )

    Begin{}
    Process
    {
        if ($complete){return ((Invoke-SplunkBase -server $server -header $header -resourcePath 'saved/searches' -outPutmode json).entry)}
        else{return ((Invoke-SplunkBase -server $server -header $header -resourcePath 'saved/searches' -outPutmode json).entry | Select name,author,updated,id)}
    }
    End{}
}
#endregion

#region Get-SplunkSearchJobs
function Get-SplunkSearchJobs{
<#
    .SYNOPSIS
	    Get list of jobs or details about a specific job

    .DESCRIPTION
        Get list of jobs or details about a specific job	

    .PARAMETER header
        Header value (use Connect-splunk to get it)

    .PARAMETER server
        FQDN for splunk server

    .PARAMETER port
        splunk server port to connect to, port 8089 is the default

    .PARAMETER sid
       The default is to return a summary of jobs, this will also get the Search ID (sid) that you can feed back in to get more details about a job

    .EXAMPLE
	    Get-SplunkListSavedSearches -server $server -header $header

    .NOTES
	    
#>
    [CmdletBinding()]
    Param
    (
        [parameter(Mandatory)]
        [string]$server,

        [parameter(Mandatory)]
        [System.Collections.Hashtable]$header,

        [string]$port = "8089",

        [string]$sid
    )

    Begin{}
    Process
    {
        if ($sid){return (Invoke-SplunkBase -server $server -header $header -resourcePath "search/jobs/$sid" -outPutmode csv)}
        else{return (Invoke-SplunkBase -server $server -header $header -resourcePath 'search/jobs' -outPutmode csv | select label,user,sid | sort -Property label)}
    }
    End{}
}
#endregion

#region Get-SplunkSearchJobsResults
function Get-SplunkSearchJobsResults{
<#
    .SYNOPSIS
	    Get Reults of a job

    .DESCRIPTION
        Get Reults of a job.  It can return a lot of data, consider piping through Select to narrow it down.	

    .PARAMETER header
        Header value (use Connect-splunk to get it)

    .PARAMETER server
        FQDN for splunk server

    .PARAMETER port
        splunk server port to connect to, port 8089 is the default

    .PARAMETER sid
       Search ID (sid), use Get-SplunkSearchJobs to get this

    .PARAMETER resultSize
        Limit the number of results to return.  100 is the default.  Use zero to get all

    .EXAMPLE
	    

    .NOTES
	    
#>
    [CmdletBinding()]
    Param
    (
        [parameter(Mandatory)]
        [string]$server,

        [parameter(Mandatory)]
        [System.Collections.Hashtable]$header,

        [string]$port = "8089",

        [parameter(Mandatory)]
        [string]$sid,

        [string]$resultSize
    )

    Begin{}
    Process
    {
        return (Invoke-SplunkBase -server $server -header $header -resourcePath "search/jobs/$sid/results" -outPutmode csv -resultSize $resultSize)
    }
    End{}
}
#endregion