topic Re: Capture data from scripted input in Getting Data In

Capture data from scripted input

tsheets13 — Wed, 30 Sep 2020 03:30:23 GMT

I'm trying to so a simple ps for ssh connections from a specific user. I have created a python script

! /usr/bin/python

import os
os.system("ps -ef|grep 'sshd: myuser'|wc -l")

I've configured the script in inputs.conf

[script://$SPLUNK_HOME/etc/apps/CheckSSH/bin/chkssh.py]
disabled = false
index = testing
interval = 30 #frequency to run the script, in seconds
source = ssh_myuser
sourcetype = ssh_myuser

However, when I search for "sourcetype=ssh_myuser" I get no results.

ideas?

Re: Capture data from scripted input

mydog8it — Thu, 02 Jan 2020 15:32:10 GMT

Search for errors in the _internal Splunk logs:

index=_internal error chkssh.py

If there are no logs in _internal for the script you can also check the local logs on the machine running the script:

$SPLUNK_HOME/var/log/splunk/

On the host running the script, have you verified connectivity to the Splunk endpoint? Firewalls can be brutal.

If you have some more troubleshooting data, please share.

Re: Capture data from scripted input

tsheets13 — Thu, 02 Jan 2020 17:18:43 GMT

Sure enough, it didn't like the comment in the interval declaration in inputs.conf.
Working great now. Thanks

Re: Capture data from scripted input

niketn — Thu, 02 Jan 2020 19:04:49 GMT

@tsheets13 I have converted your comment to answer. Please accept the same to mark this question as answered and assist others facing similar issue.