https://community.splunk.com/t5/Deployment-Architecture/Question-on-shell-script-for-linux/m-p/64440#M2213 <P>And also, that may not be the first task you wish to try if you're just starting out. Try monitoring /var/log/messages or some similar log file, which a) has chronological timestamps and b) gets updated fairly often. </P> <P>/K</P> Mon, 16 Sep 2013 17:19:53 GMT kristian_kolb 2013-09-16T17:19:53Z https://community.splunk.com/t5/Deployment-Architecture/Question-on-shell-script-for-linux/m-p/64438#M2211 <P>Hi i am new to splunk and recently just setup a forwarder (Ubuntu system) and a indexer (Window 7).<BR /> Would like to use shell script to forward data to indexer but not too sure how i should code the shell script for it to work. For example if i wan to forward info on (ls -l $Home) how should i put it in the script for splunk to read it?</P> <P>the ls -l $Home should display something like:<BR /> drwxr-xr-x 2 test test 4096 Sep 16 17:47 Desktop<BR /> drwxr-xr-x 2 test test 4096 Sep 14 16:11 Documents<BR /> drwxr-xr-x 2 test test 4096 Sep 14 18:02 Downloads</P> <P>i tried creating a test.sh with content (ls -l $Home) to test but it does not work.<BR /> Really hope someone would give me an example on this thanks.</P> Mon, 16 Sep 2013 16:23:39 GMT https://community.splunk.com/t5/Deployment-Architecture/Question-on-shell-script-for-linux/m-p/64438#M2211 darksky21 2013-09-16T16:23:39Z https://community.splunk.com/t5/Deployment-Architecture/Question-on-shell-script-for-linux/m-p/64439#M2212 <P>Have you configured inputs.conf to run the script?</P> Mon, 16 Sep 2013 16:58:04 GMT https://community.splunk.com/t5/Deployment-Architecture/Question-on-shell-script-for-linux/m-p/64439#M2212 lukejadamec 2013-09-16T16:58:04Z https://community.splunk.com/t5/Deployment-Architecture/Question-on-shell-script-for-linux/m-p/64440#M2213 <P>And also, that may not be the first task you wish to try if you're just starting out. Try monitoring /var/log/messages or some similar log file, which a) has chronological timestamps and b) gets updated fairly often. </P> <P>/K</P> Mon, 16 Sep 2013 17:19:53 GMT https://community.splunk.com/t5/Deployment-Architecture/Question-on-shell-script-for-linux/m-p/64440#M2213 kristian_kolb 2013-09-16T17:19:53Z https://community.splunk.com/t5/Deployment-Architecture/Question-on-shell-script-for-linux/m-p/64441#M2214 <P>Make the shell script executable, chmod a+x tesh.sh then configure it in inputs.conf. It works.</P> Mon, 16 Sep 2013 18:21:33 GMT https://community.splunk.com/t5/Deployment-Architecture/Question-on-shell-script-for-linux/m-p/64441#M2214 linu1988 2013-09-16T18:21:33Z https://community.splunk.com/t5/Deployment-Architecture/Question-on-shell-script-for-linux/m-p/64442#M2215 <P>Hi,</P> <P>You can write anything in the shell script. Just remember to make it executable and then use "scripted-inputs" method of data input to call that script.</P> <P>Check out <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Setupcustominputs#Add_a_scripted_input_via_inputs.conf">http://docs.splunk.com/Documentation/Splunk/latest/Data/Setupcustominputs#Add_a_scripted_input_via_inputs.conf</A> for more details.</P> <P>Regards,<BR /> Amit Saxena</P> Mon, 16 Sep 2013 18:23:47 GMT https://community.splunk.com/t5/Deployment-Architecture/Question-on-shell-script-for-linux/m-p/64442#M2215 amit_saxena 2013-09-16T18:23:47Z https://community.splunk.com/t5/Deployment-Architecture/Question-on-shell-script-for-linux/m-p/64443#M2216 <P>Thanks it works after changing the script to executable</P> Tue, 17 Sep 2013 01:57:43 GMT https://community.splunk.com/t5/Deployment-Architecture/Question-on-shell-script-for-linux/m-p/64443#M2216 darksky21 2013-09-17T01:57:43Z https://community.splunk.com/t5/Deployment-Architecture/Question-on-shell-script-for-linux/m-p/64444#M2217 <P>Thanks it works after changing the script to executable</P> Tue, 17 Sep 2013 01:58:34 GMT https://community.splunk.com/t5/Deployment-Architecture/Question-on-shell-script-for-linux/m-p/64444#M2217 darksky21 2013-09-17T01:58:34Z