topic Re: Custom scripts in Splunk in Splunk Search

Custom scripts in Splunk

viverma5 — Tue, 05 Aug 2014 06:47:09 GMT

Hi,

I need to understand that does SPLUNK supports creating our own scripts/java codes to read data from some security devices which have custom API to read data from.
Like, sourcefire estreamer user custom API, so can I built my own code in SPLUNK which reads data from sourcefire. If yes then how it is possible?
Do we have some links available?

Re: Custom scripts in Splunk

martin_mueller — Tue, 05 Aug 2014 06:52:19 GMT

Yes, custom inputs can be plain scripts or modular inputs.
http://docs.splunk.com/Documentation/Splunk/6.1.2/AdvancedDev/ScriptedInputsIntro
http://docs.splunk.com/Documentation/Splunk/6.1.2/AdvancedDev/ModInputsIntro

You mentioned Java - the Java SDK has support for modular inputs as well.
http://dev.splunk.com/view/java-sdk/SP-CAAAER2

You can package those inputs in your own app if you like, and even publish that on Splunk Apps (optional).

Re: Custom scripts in Splunk

derekarnold — Tue, 05 Aug 2014 18:26:47 GMT

Perhaps the solution is even easier, have you looked at the Splunk for Sourcefire app?

http://apps.splunk.com/app/664/

Re: Custom scripts in Splunk

viverma5 — Wed, 06 Aug 2014 05:33:33 GMT

Thanks @martin_mueller for valuable information.

@derekarnold, I have considered this as an option but what I am curious is about the reliability of these apps. If something goes wrong tomorrow so who can support this? Do we have separate license for these apps?