topic Re: trying to read a script out using UF in Getting Data In

trying to read a script out using UF

arunkuriakose — Mon, 12 Aug 2024 12:27:35 GMT

Hi Splunkers

The idea is to pull any new file creations on a particular folder inside C:\users\<username>\appdata\local\somefolder

i wrote a batch script to pull and index this data. its working but the issue is i cannot define a token for users.

eg: In script if i mention the path as C:\users\<user1>\appdata\local the batch script will run as expected an data will be indexed to splunk but if i mention the user1 as %userprofile% or %localappdata% the batch script is not running. How to resolve this

Re: trying to read a script out using UF

PickleRick — Mon, 12 Aug 2024 13:14:53 GMT

You can expect Splunk to use environmental variables only in the cases documented in conf file specs. So if you want to use a variable's value you need to resolve the variable yourself within the script.

Re: trying to read a script out using UF

arunkuriakose — Mon, 12 Aug 2024 15:39:20 GMT

Hi @PickleRick

thanks for the response

i tried something similar to this . I tried to fetch %userprofile% and saved it to a variable and then call the variable as part of another command but it didnt help. Can you give an example

Re: trying to read a script out using UF

PickleRick — Thu, 15 Aug 2024 08:13:20 GMT

You simply have to use the variable any way is appropriate for the programming/scripting solution you're using - powershell, python, whatever.

One important thing though - %USERPROFILE% in case of a scripted input run by splunkd.exe will at best point to Splunk Forwarder's technical user's profile. Is that what you want? Why not simply use the forwarder's SPLUNK_HOME variable then?