Getting Data In

How can we programatically disable/enable a data input?

dl-it-serveradm
Engager

We have an issue where for some reason, Splunk stops reading a log file in a particular Data Input folder. The log is set to roll hourly.

If we disable the Data Input, and then Re-Enable it, it starts reading the log again (which is probably the next log).

We have a scheduled task that runs every hour to determine if it has captured any data in the past hour. If it has not, we receive an email letting us know it is hung up and we have to Disable/Enable again.

Is there a way to do so via a script?

We are working to figure out what is wrong and have a case open, but are looking for an intermediary solution.

Thanks.

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi dl-it-serveradmin,

the easiest way is to use the REST API. Here is a screenshot of the input before the command:
alt text

By using this command:

  curl -k -u admin:<YourPWDHere> https://localhost:8089/servicesNS/nobody/search/data/inputs/monitor/%252Ftmp -d disabled=true

I was able to disable the input:
alt text

The reverse command would be:

 curl -k -u admin:<YourPWDHere> https://localhost:8089/servicesNS/nobody/search/data/inputs/monitor/%252Ftmp -d disabled=false

But I would also check this docs page about how Splunk handles log file rotation http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled because maybe you just need to change the way the files gets rotated and there will be no more need for the disable/enable action.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi dl-it-serveradmin,

the easiest way is to use the REST API. Here is a screenshot of the input before the command:
alt text

By using this command:

  curl -k -u admin:<YourPWDHere> https://localhost:8089/servicesNS/nobody/search/data/inputs/monitor/%252Ftmp -d disabled=true

I was able to disable the input:
alt text

The reverse command would be:

 curl -k -u admin:<YourPWDHere> https://localhost:8089/servicesNS/nobody/search/data/inputs/monitor/%252Ftmp -d disabled=false

But I would also check this docs page about how Splunk handles log file rotation http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled because maybe you just need to change the way the files gets rotated and there will be no more need for the disable/enable action.

Hope this helps ...

cheers, MuS

thkwon
Explorer

Hello Mus
I have a similar question.
Script input
Do you know how to disable /opt/splunk/bin/scripts/test.sh?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...