I want to be able to reference input scripts in one app from another app. How can I do that when the script is defined using relative paths?
For example, I have the Splunk Add-on for Unix and Linux, and I want to leverage CPU statistics gathered by the input script
cpu.sh in the app "Jane's App for Using UNIX Data to End World Hunger".
When I invoke
cpu.sh from the Splunk Add-on for Unix and Linux, the inputs.conf stanza header is defined as
script://./bin/cpu.sh. How do I invoke the
cpu.sh input script from "Jane's App for Using Unix Data to End World Hunger" given that the UNIX notation for shifting up a directory (
..) is not available with Splunk scripted inputs?
Scripted inputs are often defined using relative paths. When a script is located in an app's
bin directory, you can define the scripted input stanza header in
script://./bin/cpu.sh. If you want to leverage that same input script in another app, you have to find a different way to reference the script from the context of the other app.
Before we jump into some options, review some of the principles behind where to place the scripts for scripted inputs in the Splunk Enterprise Getting Data In manual and the inputs.conf spec file, specifically the scripted input section.
In the Splunk Add-on for Unix and Linux, the stanza header for the
cpu.sh script in
To refer to this from outside the Splunk Add-on for Unix and Linux app (literally named
Splunk_TA_nix on the filesystem), you can use the
$SPLUNK_HOME variable that exists in Splunk's runtime environment:
While they look different, those two paths calculate to the same fully qualified path, and thus use the same script! The
$SPLUNK_HOME variable means this works both on a Universal Forwarder and a full Splunk Enterprise.
Due to changes in the way Splunk processes scripted inputs, the above approach is no longer encouraged. Functionally, it works. But administratively, your new input stanza,
script://$SPLUNK_HOME/etc/apps/Splunk_TA_nix/bin/cpu.sh will not be merged with the configuration of the original input stanza,
script://./bin/cpu.sh. Therefore, your new stanza must also include the other settings like
Stronger approaches are recommended in the post What are best practices for deploying an add-on with slightly different configurations?. Nonetheless, this post is still valid at answering the specific question of referencing scripted inputs in other apps.