Neo4j Commands App

Overview

Details

This app contains new search commands and a way to configure several accounts to work with a Neo4j graph database.

If you have your own Neo4j graph database you can use the gsearch or gsearchgen command to read content from your existing graph database and combine that with information within Splunk. Be sure that the accounts for these searches are read_only. But the commands themselves do filter out neo4j [CREATE|DELETE|MERGE] commands.

Another app called "Common Metadata Data Model"(itmip_neo4j_cmdm) is meant for:
- Synchronizing ServiceNow CMDB CIs and their relationships into a Neo4j graph database.
- Synchronizing ServiceNow Users and Groups (ITIL and config) into a Neo4j graph database.
- Synchronizing ServiceNow Incident, Changes and Problems and their relationships of CI's and Users/Groups into a Neo4j graph database.
- All ServiceNow classes/tables and fields are fully customizable through the WEB UI.
- Modular inputs for synchronizing Splunk data into a Neo4j graph database. This is a form of discovery but then the source is Splunk.
- new search commands for writing into a Neo4j graph database.
To use the "Common Metadata Data Model"(itmip_neo4j_cmdm) a paid license is needed.

The CMDM app: https://splunkbase.splunk.com/app/5508/. If you have interest and want to know more please send an email to: eduard.lekanne@itmip.nl and I will be in contact with you.

License: free

The 2.x release is only using a HTTPs connection to the HTTP(s) API of Neo4j and is as such suitable for use in Splunk Cloud. If on-premise and a connection can only be used with the Neo4j BOLT protocol use the older 1.x release.

For documentation about the search commands and how to setup please visit: https://docs.thedutchdatadifference.nl/

Release Notes

Version 2.2.2

March 31, 2022

This version has to following changes:
- Build in a check for Services not having a "services_depends_on" field (Some services found in SAP Content Pack)
- When selecting "output=itsi" it no longer query the ITSI Services and Entities anymore.

Version 2.2.0

Feb. 20, 2022

This release contains the following:
- gpath command fully working with the Neo4j HTTP(s) API
- Removed Neo4j bolt python drivers
- Communication is now based on the Neo4j HTTP(s) API
- Version is build with the latest Splunk Add-on Builder version 4.0.0
- Splunk Cloud ready.
- purely python 3 based
- fixed defect where the code incorrectly checked for https

Version 2.1.2

Jan. 10, 2022

This release contains the following:
- Removed Neo4j bolt python drivers
- Communication is now based on the Neo4j HTTP(s) API
- Version is build with the latest Splunk Add-on Builder version 4.0.0
- Splunk Cloud ready.
- purely python 3 based
- gpath command is not yet available in this release as it need more coding. Although a small start is made with making it working with the ITSI API.
- fixed defect where the code incorrectly checked for https

Version 2.0.1

Dec. 2, 2021

Version 1.0.2

April 30, 2021

This release contains the following updates:
- gsearch is now a real reporting command and takes input from Splunk to search for in Neo4j
- Cleaned up the searchbnf
- gpath command has now selectable label field parameter.

929

Downloads

Share Subscribe

Version

Built by

Eduard Lekanne

Support

Not Supported

Questions on Splunk Answers Flag as inappropriate