topic Collect data from windows hosts via a command line command? in Getting Data In

Collect data from windows hosts via a command line command?

Pierceyuk — Wed, 30 Apr 2014 10:18:43 GMT

Hi All,

I have a system that runs a service, the only way to get data out and see the status is to go onto the box and run 'system name stats'

It then outputs data in format:

Variable name: value

Variable name2: value

Or 'Error not running' if its broken.
Is there a way to script this input in Splunk so it runs every 10-15 minutes to collect this information?

System is McAfee MOVE AV offload scanner, the details reset after each reboot/service reboot otherwise the details keep increasing in value if that's important

command is 'mvadm stats'

Sample result:

Total number of cksum req:               21119723
Total number of file transfer req:        4893939
Total number of smart file req:            570794
Cksum cache hit:                         16218566
Total av scan req:                        4893843
Total av scan failure:                          0
Data recv failure:                           7445
Resp send failure:                            235
Total scan threads:                           300
Total heart beat threads:                     757
Total idle threads:                           299
Number of requests in queue:                    0
Number of items in cache:                  934445
Avg request process time:                0.060458 sec
Avg request wait time:                   0.000026 sec

Re: Collect data from windows hosts via a command line command?

MuS — Wed, 30 Apr 2014 11:48:38 GMT

Hi Pierceyuk,

Yes, this is possible in Splunk.

If you're using a Splunk universal forwarder on this McAfee MOVE AV offload scanner, you can setup a script which will run the command and will be triggered by Splunk UF (universal forwarder) so the Splunk indexer will index the result in the end.

Please read the docs about scripted inputs to learn more on this.

hope this helps to get you started ...

cheers, MuS

Re: Collect data from windows hosts via a command line command?

Pierceyuk — Wed, 30 Apr 2014 12:21:08 GMT

Hi, Yes I am indeed running a UF on these devices, will take a look thanks for the pointers!