topic Re: Splunk running script advice in Getting Data In

Splunk running script advice

MHibbin — Mon, 05 Dec 2011 11:31:53 GMT

Hi SplunkBase,

How do I make Splunk start a script (not as an input)? -the script generates log files which I can then monitor in Splunk. Or, is there a way of making the script run as an input continuously (i.e. not running on intervals)?

Basically, I want the script to run when ever Splunk is, and would rather not add an entry to cron (making it safer when distributing in an environment).

Any advice welcome on best practices.

Regards,

MHibbin

Re: Splunk running script advice

Drainy — Mon, 05 Dec 2011 11:41:24 GMT

I believe if you set it as a scripted input with an interval of -1 (via config only, GUI won't accept a -1 value) then Splunk will keep it running and restart it if it isn't running.
As long as it is only doing file output then Splunk won't have anything to index from it and it can happily generate log data. Saying that you might find it worthwhile generating some stdoutput from it for logging purposes (direct it to _internal for debugging your script)

Re: Splunk running script advice

MHibbin — Mon, 05 Dec 2011 12:38:37 GMT

Thanks for getting back to me. I'll give this a try.

Thanks for the suggestion about stdout, I have already set up info/error codes for this though. 🙂

Re: Splunk running script advice

MHibbin — Mon, 05 Dec 2011 12:53:17 GMT

Yeah this appears to be working. Thanks for the answer.

Re: Splunk running script advice

DUThibault — Wed, 06 Sep 2017 15:06:43 GMT

What if you a) want the script to run just once and b) don't want to actually import the script's output? This happens if, for instance, one is managing a Splunk single-instance server remotely and need to run an app's setup script (e.g. the Splunk Reference App - PAS from Splunkbase needs its bin/install-addons.sh to be run).