Getting Data In

Can a scripted input be deployed on universal forwarders via deployment server?

Path Finder


I need inputs from a timely scheduled script from a remote server.

Can I configure this script on deployment server, placing the script in $SPLUNK_HOME$/deploymentapps/<app_name>/bin/ & the respective inputs, props, and other conf files in $SPLUNK_HOME$/deploymentapps/<app_name>/local/ . Then push these settings to respective hosts with Splunk universal forawrders installed

0 Karma

New Member

I know this thread has been quite sometimes but I'd like to share my answers in case it'd help others.
I've had success settings up scripted input running at an interval (in seconds) for UF v6.2.1 which is pretty simple:

  1. Make sure you place your script under folder ..//bin/scripts/ with proper execute permission (in case in linux)
  2. Configure scripted input inputs.conf pointing to the script correctly


for script placement

for inputs.conf configuration
sourcetype = mysourcetype
index = myindex
interval = 60.0
disabled = false

Make sure you placed above configs in your deployment server and perform deploy-server to push this to your HF.
This is with assumptions you've correctly setup the UF deploymentclients.conf, the outputs.conf and other neccessary setup accroding to your existing splunk architectural layout.

0 Karma


Possible. You can push Apps/TA (e.g. Windows Infra App, *nix app) which can have scripts using deployment server.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...