Do we need to have universal forwarder installed in host server when we are going for scripted inputs?

[raj_mpl]

Hi All,

A straight question
1) If I want to get the database related log into splunk indexer using scripted inputs , does the Universal forwarder needs to be installed in host ?
2)If Yes , How to make the scripted input to send the log into indexer ?

Thank you !

[darrenfuller]

Hi @raj_mpl,

Sure, Universal Forwarder is the preferred method to transfer scripted input data, but UF is not the only way to get the output of a script into Splunk.

There are plenty of reasons i can think of to not install a forwarder.. Unsupported OS; Corporate Security policies against agents; Oversubscribed boxes with limited resources; Because you don't want to.

Here is a method off the top of my head...

1. Create script that does $things$
2. Install script on the target server
3. Run script from cron and output result to file
4. Transmit log file to remote syslog server
   
5. Install UF on syslog server to forward data into Splunk.

To make your life easier, have the script output one event per line, include a timestamp, and maybe use JSON or csv formatting to get the auto-field-extraction fun.

Hope this helps.

[raj_mpl]

Thanks @darrenfuller , Your inputs are worth to me

[gcusello · Accepted solution]

Hi raj_mpl,
if you use a scripted inputs it's better to install a Universal Forwarder on the target server for many reasons (cache, bandwidth optimization, compression, etc...), I don't like to run a remote script.

Anyway, to do this, you have to:

• install the Splunk Universal Forwarder on the target server,
• create a Technical Add-on (TA),
• put your script in $your_TA/bin,

• edit $your_TA/local/inputs.conf and adding a stanza like the following.

  [script://./bin/your_script.sh]
  disabled = 0

  Run once per minute

  interval = 60
  sourcetype = your_sourcetype
  index = your_index

• then restart the Universal Forwarder.

It's better to deploy this TA using a Deployment Server.

Bye.
Giuseppe

[raj_mpl]

Thanks @cusello , Its very clear that you have explained here .