topic Re: where does splunk store output of shell scripts? in Splunk Search

where does splunk store output of shell scripts?

batemanj — Wed, 30 Sep 2020 02:58:26 GMT

Hi,

On Splunk forwarders, we have few shell scripts in "SPLUNK_HOME/etc/apps/my_app/bin/" that are being run. Just wondering where do the outputs of these shell scripts store? Shell scripts don't have the output filename in them so I tried to look into "SPLUNK_HOME/var/log/splunk" but no luck. Are these outputs store in "*.dat" file which we can't read?

Thanks

Re: where does splunk store output of shell scripts?

burwell — Sat, 16 Nov 2019 20:08:49 GMT

So you are doing scripted input? Splunk runs the script on the interval you specify and then indexes the output. I don't think there's an intermediate location.

Re: where does splunk store output of shell scripts?

woodcock — Sun, 17 Nov 2019 01:07:18 GMT

If you are running scripted inputs, then Splunk will index the output that it sees hitting stdout. This means that you can pipe the output of your scripts to other things and Splunk will only index the final text that hits stdout. Any other output that goes anywhere else will be ignored by Splunk, unless of course you are writing it to file and have a different [monitor://...] stanza looking for it, which would be strange.