topic Re: How do you run a Python script on a universal forwarder before taking input? in Getting Data In

How do you run a Python script on a universal forwarder before taking input?

yashjain12yj — Tue, 29 Jan 2019 10:18:19 GMT

I want to take input from a forwarder, but before that, I want to filter the data with the help of a Python script.

Just like in a normal monitoring option, I used script to monitor a folder; like that, I want to monitor a folder on a box drive, but I want to use a script to pre-filter the data coming to Splunk.

Re: How do you run a Python script on a universal forwarder before taking input?

renjith_nair — Tue, 29 Jan 2019 15:04:59 GMT

@yashjain12yj,

You may filter the data using splunk props.conf & transforms.conf instead of scripts .
Reference : Route and filter data

If you still want to alter the data before pushing to splunk, one of the possible solution is

Push the logs/files to a staging area
Alter the data using python scripts
Move the modified file to the location where Splunk monitor is configured.