topic Re: Scripted input question for batch file in Getting Data In

Scripted input question for batch file

sieutruc — Mon, 10 Sep 2012 14:23:18 GMT

Hello,
I cannot get the value of scripted input by using batch file as wrapper script. My configuration is as below:
MemoryPerf.bat and counters.exe in etc\system\bin

@ECHO OFF 

counters.exe 6 Memory "Page Faults/sec" "%% Committed Bytes In Use" "Committed Bytes" "Pages/sec" "Available MBytes"

Inputs.conf in etc\system\local

[script://$SPLUNK_HOME\etc\system\bin\MemoryPerf.bat]
interval = 6
index = default
source = cript://MemoryPerf.bat
disabled = 0

But after that, it didn't work. i opened task manager and did't see the counters instance in the list too. Do you know what wrong i did ?

Re: Scripted input question for batch file

adamw — Mon, 10 Sep 2012 16:20:12 GMT

Your source= might be causing an issue. By default, Splunk will set up the source value to $SPLUNK_HOME\etc\system\bin\MemoryPerf.bat, I would comment out this line and see if it starts working.

Also, take a look at $SPLUNK_HOME\var\log\splunk\splunkd.log, and it should tell you if the script is actually executing or not. You can also run $SPLUNK_HOME\bin\splunk cmd btool inputs list to see if you can find your script listed, as this will indicate if the configuration is correct.

Re: Scripted input question for batch file

sieutruc — Tue, 11 Sep 2012 07:58:00 GMT

I have already found the solution. Intuitively, i guess that Splunk, when it runs, it will set the current directory for batch file as C:\Windows\system32 to get cmd.exe. So in order to change back to the current place where the batch file is being stored, we use a small trick and put it at the beginning of the batch script as

@ECHO OFF

cd /d %~dp0

[your script at the same folder as batch file]

Thanks for your suggestion about splunkd.log.