I have a system that runs a service, the only way to get data out and see the status is to go onto the box and run 'system name stats'
It then outputs data in format:
Variable name: value
Variable name2: value
Or 'Error not running' if its broken.
Is there a way to script this input in Splunk so it runs every 10-15 minutes to collect this information?
System is McAfee MOVE AV offload scanner, the details reset after each reboot/service reboot otherwise the details keep increasing in value if that's important
command is 'mvadm stats'
Total number of cksum req: 21119723 Total number of file transfer req: 4893939 Total number of smart file req: 570794 Cksum cache hit: 16218566 Total av scan req: 4893843 Total av scan failure: 0 Data recv failure: 7445 Resp send failure: 235 Total scan threads: 300 Total heart beat threads: 757 Total idle threads: 299 Number of requests in queue: 0 Number of items in cache: 934445 Avg request process time: 0.060458 sec Avg request wait time: 0.000026 sec
Yes, this is possible in Splunk.
If you're using a Splunk universal forwarder on this McAfee MOVE AV offload scanner, you can setup a script which will run the command and will be triggered by Splunk UF (universal forwarder) so the Splunk indexer will index the result in the end.
Please read the docs about scripted inputs to learn more on this.
hope this helps to get you started ...