topic Re: Why am I getting error "Could not find script on deployment client" trying to add a local script on the universal forwarder from the deployment server? in Getting Data In

Why am I getting error "Could not find script on deployment client" trying to add a local script on the universal forwarder from the deployment server?

thejohn — Sat, 27 Jun 2015 13:17:33 GMT

How do I add a local script on the forwarder from the deployment server?
I've put the script on the Universal forwarder in $SPLUNK_HOME\bin\scripts\ and tried to configure it on the server like so:

Add Data -> Select Forwarder -> Source: Scripts -> Command: $SPLUNK_HOME\bin\scripts\scan.bat

and on the last step, submit, it says Could not find file $SPLUNK_HOMEbinscriptsscan.bat.
It seems like you can't specify scripts local to the UF? Only scripts on the server? Is this right or I am doing something wrong?

Also I know I can configure this in inputs.conf on the UF, but it would be much better to do this from the Splunk Web UI than to rdp to the UF each time I need to add a script.

Re: Why am I getting error "Could not find script on deployment client" trying to add a local script on the universal forwarder from the deployment server?

martin_mueller — Sat, 27 Jun 2015 13:32:54 GMT

You can specify a script local to the UF in inputs.conf of a deployment app. While the UI may not allow this, you certainly can add a script://... entry on the Deployment Server directly and deploy that out to the UF.

Re: Why am I getting error "Could not find script on deployment client" trying to add a local script on the universal forwarder from the deployment server?

thejohn — Sat, 27 Jun 2015 14:05:39 GMT

Oh ok that might work. But its a shame this can't be done in UI. You can monitor files and directories from UI, local to forwarders so I think you should be able to run local scripts too.

Re: Why am I getting error "Could not find script on deployment client" trying to add a local script on the universal forwarder from the deployment server?

martin_mueller — Sat, 27 Jun 2015 14:26:39 GMT

Feel free to submit a case to support requesting this feature.