Splunk Search

Pass arguments for shell script in inputs.conf?

ansif
Motivator

How to pass arguments to a script from inputs.conf?

example:
shell_script.sh server1 server2

Tags (1)
0 Karma

PavelP
Motivator

Hello @ansif

you cannot use parameters in the script stanza. Insted you should use .path format, which is more flexible:

[script://<cmd>]
* Runs <cmd> at a configured interval (see below) and indexes the output
  that <cmd> returns.
* The <cmd> must reside in one of the following directories:
  * $SPLUNK_HOME/etc/system/bin/
  * $SPLUNK_HOME/etc/apps/$YOUR_APP/bin/
  * $SPLUNK_HOME/bin/scripts/
* The path to <cmd> can be an absolute path, make use of an environment
  variable such as $SPLUNK_HOME, or use the special pattern of an initial '.'
  as the first directory to indicate a location inside the current app.
* The '.' specification must be followed by a platform-specific directory
  separator.
  * For example, on UNIX:
        [script://./bin/my_script.sh]
    Or on Windows:
        [script://.\bin\my_program.exe]
    This '.' pattern is strongly recommended for app developers, and necessary
    for operation in search head pooling environments.
* <cmd> can also be a path to a file that ends with a ".path" suffix. A file
  with this suffix is a special type of pointer file that points to a command
  to be run. Although the pointer file is bound by the same location
  restrictions mentioned above, the command referenced inside it can reside
  anywhere on the file system. The .path file must contain exactly one line:
  the path to the command to run, optionally followed by command-line
  arguments. The file can contain additional empty lines and lines that begin
  with ''. The input ignores these lines.
0 Karma

to4kawa
Ultra Champion

You can write as it is

0 Karma

ansif
Motivator

Thanks @to4kawa to confirm.

One additional question, can we keep one single addon and enable inputs argumnets based on the server which we deployed?

Like splunk-addon-shellscript

inputs.conf

Server1

[script:abc.sh "argument1"]
disabled=0

[script:abc.sh "argmnet2"]
disabled=1

Server2

[script:abc.sh "argument1"]
disabled=1

[script:abc.sh "argmnet2"]
disabled=0

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...