topic Re: How to get output from external commands run through Perl and use as scripted input in Splunk Search

How to get output from external commands run through Perl and use as scripted input

samaikins — Wed, 30 Mar 2016 07:06:22 GMT

Am trying to run a command through perl and the results used as scripted input which will be indexed by splunk.
However i dont get any output when i run the script through splunk.
i have tried the perl "system" module and "backticks" but none of it works.

The script works fine if i run it manually through the command line.

$myresults = `find $flags[0] -maxdepth 1 -type f -name $flags[1] -mmin $min_val -ls`;
print  $myresults

The script has been added to the input.conf.

Some help will be much appreciated

Thanks
Sam

Re: How to get output from external commands run through Perl and use as scripted input

jmallorquin — Wed, 30 Mar 2016 09:35:25 GMT

Hi,

Use the bin folder to write a sh script with you perl command, then in the inputs.conf configure a stanza with the sh script.

Hope i help you.

Re: How to get output from external commands run through Perl and use as scripted input

samaikins — Wed, 30 Mar 2016 09:47:03 GMT

Hi
sorry i forgot to mention i have already done that.
regular print statement in the script works fine.its just the ones with commands that doesnt work

Re: How to get output from external commands run through Perl and use as scripted input

jmallorquin — Wed, 30 Mar 2016 09:54:02 GMT

Hi,

Can you show the inputs.conf conf and also have you check that the user of splunk have rights to execute the script?

Re: How to get output from external commands run through Perl and use as scripted input

samaikins — Tue, 29 Sep 2020 09:13:34 GMT

this is the input.conf and running this from the admin account

[script://$SPLUNK_HOME/etc/apps/dir_patrol/bin/dir_patrol.pl]
disabled = 0
interval = 60.0
sourcetype = dir_patrol

Re: How to get output from external commands run through Perl and use as scripted input

jmallorquin — Wed, 30 Mar 2016 11:14:30 GMT

Hi,

The problem is in the stanza

you have to use

[script://./bin/dir_patrol.pl]
disabled = 0
interval = 60
sourcetype = dir_patrol

Hope i help you

Re: How to get output from external commands run through Perl and use as scripted input

samaikins — Wed, 30 Mar 2016 11:27:16 GMT

hi
changing the input.conf didnt help.
just to clarify.
The actual script works.only this line below doesnt return any results
"$myresults = find $flags[0] -maxdepth 1 -type f -name $flags[1] -mmin $min_val -ls;"

Re: How to get output from external commands run through Perl and use as scripted input

jmallorquin — Wed, 30 Mar 2016 13:07:01 GMT

Ok,
So the problem is with perl... have you try to build the command before execute?

$command =  "find." ".$flags[0]." -maxdepth 1 -type f -name"." ".$flags[1]." -mmin ".$min_val." -ls";

printf($command);
system($command);

Hope i help you

Re: How to get output from external commands run through Perl and use as scripted input

samaikins — Thu, 31 Mar 2016 06:36:12 GMT

i tried your method ,i see no errors.However the command does not show any results.

Re: How to get output from external commands run through Perl and use as scripted input

jmallorquin — Thu, 31 Mar 2016 10:22:12 GMT

Hi,
review the _internal index to see if there is any error.

hope i help you

Re: How to get output from external commands run through Perl and use as scripted input

samaikins — Mon, 11 Apr 2016 03:28:54 GMT

Hi Jmallorquin,

i found out scripted input in splunk doesnt seem to work well with linux "find" with the "-ls" flag

find . -maxdepth 1 -type f -name "*.xml" -mmin 300 -ls

when i use the find command without "-ls" it get an output

Re: How to get output from external commands run through Perl and use as scripted input

samaikins — Tue, 12 Apr 2016 09:40:11 GMT

an was provided in this
https://answers.splunk.com/answers/390425/scripted-input-and-not-working-well-with-linux-fin.html#answer-390458