topic Re: manually run a scripted input? in Getting Data In

manually run a scripted input?

jeff — Fri, 14 Dec 2012 14:36:25 GMT

I have a scripted input in Splunk that sends it's data to Splunk via STDOUT. Is there any way to run the script on-demand and have the results sent to Splunk without restarting Splunk? Something like a "oneshot" cli method, but for scripted inputs, not for files.

Re: manually run a scripted input?

alacercogitatus — Fri, 14 Dec 2012 14:52:50 GMT

What OS are you running?

Re: manually run a scripted input?

itinney — Fri, 14 Dec 2012 14:59:07 GMT

If you write the output to a file in a sinkhole like, .../var/spool/splunk, then Splunk will consume it.
If you need the sourcetype to be the same as when it runs as a script then create a different sinkhole and specify the sourcetype

Re: manually run a scripted input?

yannK — Fri, 14 Dec 2012 15:20:20 GMT

or same idea with saving the result of the script to a file and monitor the file with the correct sourcetype.

then you will have to clean the result file once a while.

Re: manually run a scripted input?

tomasmoser — Thu, 18 May 2017 16:29:52 GMT

You can disable and again enable scripted input. This will make it run. It worked for me.

Re: manually run a scripted input?

jkat54 — Wed, 17 Jul 2019 12:47:57 GMT

You can do this, but splunk wont index the data necessarily: ./splunk cmd /opt/splunk/etc/apps/yourapp/bin/script.sh

You will see STDOUT/ERR from your script though