topic Re: Scripted Input - Windows Indexer - Linux Host in Getting Data In

Scripted Input - Windows Indexer - Linux Host

runwithscizzors — Wed, 23 Jun 2010 20:05:53 GMT

Looking for the best way to collect Disk Free Space from a Linux box to a Windows Indexer. Company policy wont let me put a light weight forwarder on the host.

Would like to collect the output from a "df -h" and run this every x period of time and have the input collected into Splunk.

I know I need to run some Scripted Input from the host, but how will this work from a Windows Indexer?

Indexer - Windows 2003 Server Linux - Red Hat

Re: Scripted Input - Windows Indexer - Linux Host

Dan — Wed, 23 Jun 2010 21:12:51 GMT

Just curious what issue the company has with the light weight forwarder? Are there any changes Splunk can make to the LWF to make it compliant?

Anyway, here are a few ideas:

.bat scripted input that uses ssh to login to Linux and execute the df -h command. You'd have to install a CLI friendly ssh client on the Windows box. I'd also recommend distributing keys rather than hard-coding credentials in the script.
same kind of scripted input as above, but using snmp polling. Much more light-weight. Look at something like Cacti.
you can samba mount the disk and use Windows' native methods such as perf counters. Probably the fastest but least production-ready solution.
Would company policy allow you to put your own cron script on the Linux box that runs df -h | netcat?

Re: Scripted Input - Windows Indexer - Linux Host

Lowell — Wed, 23 Jun 2010 23:06:30 GMT

Additional suggestion based Dan's 1st suggestion. Rather than using df -h, you could use the df.sh script that's bundled in the unix app's bin folder (if you allowed to place that on the linux machine). I think you could use the plink tool in that comes with Putty (ssh client for windows). You could also use the Putty Agent to store ssh keys for the whole auth thing.