Getting Data In

Any solid example of a scripted input on Windows?

maverick
Splunk Employee
Splunk Employee

..as in, I have a .cmd or a .bat file that I would like to use as a scripted input.

I am not able to find any solid examples of how the script:// stanza within my inputs.conf file looks like that actually works.

Anyone do this already that is willing to share their stanza?

0 Karma

ndoshi
Splunk Employee
Splunk Employee

The Splunk IP Watchlist app has a simple bat file to retrieve IP addresses and uses scripted input to call this bat file to gather the data. It's a simple approach as I'm not much of a DOS style script writer.

http://splunkbase.splunk.com/apps/All/4.x/app:Global+Threat+Landscape%7FIP+Watch+list+V2

0 Karma

ziegfried
Influencer

[script://$SPLUNK_HOME\etc\apps\myapp\bin\myscript.bat]
disabled = false
index = myindex
interval = 3600
sourcetype = mysourcetype

0 Karma

jflomenberg
Splunk Employee
Splunk Employee

Also note that if you are calling a python script you'll similarly want to make sure that path within it are set in a way that Windows can handle along the lines of
theFile = open(os.path.join(os.environ["SPLUNK_HOME"], 'etc', 'apps', 'bmon-eventgen', 'bin', 'sample', 'noise_apache.sample'),'r')

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Value Insights: Now Generally Available in the CMC

Organizations are under pressure to move faster, control cost, expand AI adoption, and prove value with more ...