topic Re: Windows Scripted Input specify index in Getting Data In

Windows Scripted Input specify index

Viorel — Tue, 06 Sep 2022 12:30:51 GMT

I am probably overengineering this but this is the only way I could get a script to execute on UF, via a deployed application's bin folder 🙂

I have a .path file which executes powershell.exe -command "& 'path_to_ps1_script'" and it's placed, as stated, in myapp\bin\scripts folder

The PS1 script, returns a valid JSON.

The app's inputs.conf stanza:

[script://$SPLUNK_HOME\etc\apps\<my app>\bin\scripts\myscript.path]
disabled=false
interval=60
sourcetype=my_source_type
source=my_source
send_index_as_argument_for_path=false
index=my_index

As soon as I put index=my_index in my stanza, the data is not being indexed for some reason.

If I remove the index, the data is indexed into the default "main" index, however i'm looking for a solution to send that data to an index I specify

Any suggestions ?

Re: Windows Scripted Input specify index

richgalloway — Tue, 06 Sep 2022 12:56:25 GMT

Does my_index exist on the indexers and is it the right type?

Re: Windows Scripted Input specify index

Viorel — Tue, 06 Sep 2022 13:30:25 GMT

yes it does exist and it's of a right type ...

Forgot to mention, i'm using splunk 8.2.1

Re: Windows Scripted Input specify index

PickleRick — Tue, 06 Sep 2022 13:52:59 GMT

Well... it should work so it's strange that it doesn't.

Do you have any related errors in _internal (from either your UF or your downstream idxs/HFs)?

Re: Windows Scripted Input specify index

matt8679 — Tue, 06 Sep 2022 15:56:49 GMT

Remove these from the inputs.conf

source=my_source
send_index_as_argument_for_path=false

Re: Windows Scripted Input specify index

Viorel — Wed, 07 Sep 2022 07:18:37 GMT

For some reason, deleting the index from the indexer server and then re-creating it, fixed the issue.

Thank you all for your suggestions