Mark Vandenbos 6d61726b760a

EA9500 V1 / V1.1: The newest firmware is version 1.1.9.210876, released Sep 01, 2022, listed only as "various bug fixes". Note that some Linksys regional download pages still show the previous release, 1.1.8.204089 from 2/5/2021, so check the release notes if the page looks out of date.

EA9500 V2 / EA9500S: The latest is version 2.1.1.186574 from Mar 9, 2018, which increased the number of concurrent NAT sessions. The two firmware lines are not interchangeable: the V2 firmware is only compatible with EA9500 V2 and EA9500S, not with V1.

https://downloads.linksys.com/support/assets/releasenotes/EA9500_1.1.9.210876_Release_Notes.txt https://downloads.linksys.com/support/assets/firmware/FW_EA9500_1.1.9.210876_prod.gpg.img

Firmware Updates

Before you update:

This SPL will generate a list of HEC token strings that you could copy pasta straight into an inputs.conf (although testing & validation is always wise).

Useful if you are trying to replicate Splunk Cloud HEC tokens to Heavy Forwarders.

Example output:

[<token title>]
description = <description, (if blank, title)>
disabled = 0
index = index_1

Simulation mode

In this mode your script runs not on the server, but locally on your machine, so that you can pause and debug it.

View scripts on GitHub

Don't know how to code in JavaScript? Check out this free interactive course!

scraping prometheus endpoints with otel

the otel collector is a reasonably nice way to scrape prometheus enpoints

it is obviously designed for use with splunk's olly cloud, but the otel collector supports output to splunk hec tokens as well.

im running multiple docker containers (to seperate workloads).

first, create configs

	#!/usr/bin/env bash
	#
	# logstash_s3_sync.sh
	#
	# Changelog
	# 2026-09-02
	# - Restored logstash config verify step (real invocation, no longer commented out)
	# - Added chown of staged config to logstash:logstash before promoting to live
	# - Added lock file (flock) to prevent overlapping runs
	# - Added disable-file check to allow disabling auto sync/reload on a host

	#!/usr/bin/env python3
	"""
	PCO Chat Maker - Automated Chat Creation for PCO Plans

	This script automates the creation of Planning Center Online (PCO) chat conversations
	for upcoming church services. It identifies the next service plans for specified
	service types, extracts team information, and creates chat conversations for
	team coordination.

	Features:

	# - https://docs.splunk.com/Documentation/Splunk/latest/Data/AboutHECIDXAck
	# - https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector
	# - https://docs.splunk.com/Documentation/Splunk/latest/Data/HECExamples

	# NOTE: events sent to the RAW endpoint will land in the default index for the provided token

	# event endpoint [ack disabled]
	curl -k \
	-H "Authorization: Splunk TH1S-IS-N0T-A-R3AL-T0K3N" \
	https://splunk-heavyforwarder:8088/services/collector/event \

	import secrets
	import datetime
	import time
	import requests

	# send a random splunk string to a http event collector
	# includes some fake app names and environments
	# generates len(app_names) events every 10 seconds

	requests.packages.urllib3.disable_warnings()

	Set-PSDebug -Off

	# splunk service details
	$splunkService = "SplunkForwarder"
	# path to splunk configs
	$splunk_serverconf = 'C:\Program Files\SplunkUniversalForwarder\etc\system\local\server.conf'
	$splunk_inputsconf = 'C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf'


	# get current computername

	#!/usr/bin/python3

	# a quick and dirty dns test script
	# checks to see if we can resolve a list of hosts
	# writes to the hec endpoint on the localhost
	# (expected to be run from hfw)
	#
	# cron: * * * * * /root/dnstest.py >/tmp/dnstest.out 2>&1
	#
	# mark.vandenbos@gmail.com