Getting Data In

How do I get a Splunk script to run on all universal forwarders in my environment?

akelly4
Path Finder

I'm trying to get a script to run on all of the servers I have universal forwarders on. When I setup my script I went through the GUI to setup the script

Script path $Splunk_HOME\etc\app\search\bin
Script Name Status.cmd

The script runs but it only runs on the server. How do I get the script to run on all of the forwarders?

dwaddle
SplunkTrust
SplunkTrust

I think you may be missing something important architecturally here. To be able to "push a script" to forwarders, you need:

  1. The script itself, packaged in the form of a Splunk app. (Leaving it in the search app won't do)
  2. A Splunk deployment server to distribute the app to clients
  3. Forwarders that are configured to check in (poll) that deployment server

Without (at least) these three things you won't have success. This doc link may help you get closer:

http://docs.splunk.com/Documentation/Splunk/6.2.2/Updating/Aboutdeploymentserver

Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...