topic Where on a Windows machine should I store logs generated from custom scripts for Splunk Universal Forwarder to forward? in Getting Data In

Where on a Windows machine should I store logs generated from custom scripts for Splunk Universal Forwarder to forward?

landen99 — Mon, 07 Mar 2016 03:17:22 GMT

Running a log-generating script locally on a Windows machine with a Splunk UF, I am looking for best practices for where to store the script log files. I imagine that there may be permissions issues with trying to store them under a user account or in the Windows directory. Splunk will run the custom script either periodically or constantly.

Re: Where on a Windows machine should I store logs generated from custom scripts for Splunk Universal Forwarder to forward?

Jeremiah — Mon, 07 Mar 2016 16:02:59 GMT

If you are using Splunk to run the script, you should store the scripts in a Splunk app:

http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ScriptedInputsIntro

Place scripts in the bin directory of your app:

$SPLUNK_HOME/etc/apps/<appname>/bin/

If you have Splunk run the scripts as inputs, you don't need to generate log files. Splunk will read the script output and forward it to your indexers.