topic Re: How to correctly setup scripted (bash script) on forwarded input (UF) in HF via CLI or configuration? in Reporting

How to correctly setup scripted (bash script) on forwarded input (UF) in HF via CLI or configuration?

hamidseleman — Tue, 08 May 2018 08:34:09 GMT

Hi,
I've been googling for weeks but to no avail on how to correctly setup scripted input on HF to massage input forwarded from UF.
Following is simple setup for inputs:

inputs.conf in UF
[monitor:///path-to-log/file.txt]
sourcetype = mysourcetype
index = myindex
crcSalt = <SOURCE>
disabled = false

inputs.conf in HF
[script://./bin/scripts/massager.sh]
sourcetype = mysourcetype
index = myindex
interval = 60.0
disabled = false

Sample setup or link highly appreciated.

Thanks.

Re: How to correctly setup scripted (bash script) on forwarded input (UF) in HF via CLI or configuration?

adonio — Tue, 08 May 2018 15:00:56 GMT

hello there,

can you please elaborate?
what is it that you are trying to achieve?
you dont need any script on HF to send data that is coming from the UF, only configure inputs and outputs

Re: How to correctly setup scripted (bash script) on forwarded input (UF) in HF via CLI or configuration?

hamidseleman — Tue, 08 May 2018 23:46:44 GMT

Hi,
I am trying to massage raw log sourced at UF by running script at HF before handing off data to Indexer. I dont want to run script at UF end. This is to free up UF from additional processing requirement.

Re: How to correctly setup scripted (bash script) on forwarded input (UF) in HF via CLI or configuration?

jkat54 — Wed, 09 May 2018 01:36:48 GMT

You’ll have to “massage” the data using props and transforms on the HF and possibly the UF.

See this article: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

Re: How to correctly setup scripted (bash script) on forwarded input (UF) in HF via CLI or configuration?

hamidseleman — Wed, 09 May 2018 09:01:49 GMT

Thanks but for some reason I need to work with scripts.

Re: How to correctly setup scripted (bash script) on forwarded input (UF) in HF via CLI or configuration?

adonio — Wed, 09 May 2018 14:09:50 GMT

@hamidseleman
i am not sure what exactly you are trying to achieve and why would you have to work with scripts.
you can massage the raw data from the UF at the HF using props and transforms.

Re: How to correctly setup scripted (bash script) on forwarded input (UF) in HF via CLI or configuration?

hamidseleman — Wed, 09 May 2018 14:16:24 GMT

Hi,
what i am trying to achieve mostly is already stated exactly in the question itself. Anyway, thanks.