Backfill Scripted Input Data

raidercom — Thu, 09 Sep 2021 04:22:26 GMT

I'm running Splunk 8.2.2 in a docker container.

I'm using a separate app with a scripted input to get data into Splunk via a bash script.

That script works perfectly, except when the source API screws up, or when I delete the index and need to backfill all of the previous data.

The scripted input is setup in inputs.conf as:

[script://$SPLUNK_HOME/etc/apps/app/bin/app.sh]
interval = */5 * * * *

Is there a way to manually run a script one time and have splunk consume the output? I'd really like to avoid setting up a regular monitor, and have splunk consume a regular file just for a backfill operation. I'd also like to avoid modifying the working scripted input.

Thank you for any suggestions you can provide.

Re: Backfill Scripted Input Data

raidercom — Sat, 11 Sep 2021 21:47:29 GMT

I ended up merging 2 solutions.

1) scripted input that runs a bash script that outputs to a file

2) monitor that log file

topic Backfill Scripted Input Data in Getting Data In

Backfill Scripted Input Data

Re: Backfill Scripted Input Data