Deploy custom script, then upload the results

[mlorrette]

Newbie here. How can I output the result of a bash script back into Splunk? The script periodically sends netstat commands.

[Damien_Dallimor]

Simple :

Wire up your script using the Command Modular Input

https://splunkbase.splunk.com/app/1553/

Of course you can also refactor your script into a Splunk Scripted Input or Modular Input and deploy it in it's own App , but if you simply want to execute your script as is and capture the STDOUT in Splunk , then the Command Modular Input will work. And has some advanced stuff like plugging in your own preprocessing if you want.

[98123722 · Accepted solution]

The easiest ways I can think that would solve this for you (If I understand the question correctly), would be to either monitor stdout of the netstat script, or write the results to a file and monitor that file.

Here are some suggested steps:

-Create a new app. Follow the instructions for Scripted Inputs. In general:

1. Under /etc/deployment-apps/ , create a new app, for example: myapp .
2. Under /etc/deployment-apps/myapp/bin , place your .sh script. Out of the box, Splunk should be able to run it. Make sure to add the correct interpreter in the first line (usually /bin/bash).
3. You can output the script to a file, and have Splunk monitor that file (“Writing data to a file for indexing”). Another – quick – alternative would be to echo your netstat results to stdout (“Streaming data”). The Splunk service, which runs your script, will watch stdout and will send it back to the indexer as a single event.