All Apps and Add-ons
Highlighted

Run script without sending to index

Engager

I wish to run a python script that updates files within a monitoring directory, without directly sending any files to the index. All the examples I’ve seen have people running a script and sending logs to their index.

Would removing the sourcetype/ index fields make it act the way I want? Or will it behave the way I want as long as I’m not sending logs within the script. Sorry for any confusion.

1
2
3
4
5
[script://./bin/TA-SimpleApp.py]
interval = 10
sourcetype = my_sourcetype
disabled = False
index = main
 
Labels (2)
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.