I have a problem here. My shell script is not giving the complete output in the Splunk search head . What is the command to check and run the script in the UF?
@raj_mpl ,
If you are referring to the scripted inputs , then most likely it should be part of an app. To find the location of the script, use btool
and list all the inputs
SPLUNK_HOME/bin/splunk btool inputs list --debug|grep "your script name"
Once you find the script, you may execute them on your forwarder to verify the result by either using the absolute path or relative path.
For e.g. if your script is located in SPLUNK_HOME/etc/apps/my_app/bin/myscript.sh , you may run it using the entire path or
cd SPLUNK_HOME/etc/apps/my_app/bin/
./myscript.sh
where SPLUNK_HOME is your splunk installation directory
Reference:
Scripted Input:
[script://<cmd>]
* Runs <cmd> at a configured interval (see below) and indexes the output
that <cmd> returns.
* The <cmd> must reside in one of the following directories:
* $SPLUNK_HOME/etc/system/bin/
* $SPLUNK_HOME/etc/apps/$YOUR_APP/bin/
* $SPLUNK_HOME/bin/scripts/
* The path to <cmd> can be an absolute path, make use of an environment
variable such as $SPLUNK_HOME, or use the special pattern of an initial '.'
as the first directory to indicate a location inside the current app.
* The '.' specification must be followed by a platform-specific directory
separator.
* For example, on UNIX:
[script://./bin/my_script.sh]
Or on Windows:
[script://.\bin\my_program.exe]
This '.' pattern is strongly recommended for app developers, and necessary
for operation in search head pooling environments.
* <cmd> can also be a path to a file that ends with a ".path" suffix. A file
with this suffix is a special type of pointer file that points to a command
to be run. Although the pointer file is bound by the same location
restrictions mentioned above, the command referenced inside it can reside
anywhere on the file system. The .path file must contain exactly one line:
the path to the command to run, optionally followed by command-line
arguments. The file can contain additional empty lines and lines that begin
with '#'. The input ignores these lines.
@raj_mpl ,
If you are referring to the scripted inputs , then most likely it should be part of an app. To find the location of the script, use btool
and list all the inputs
SPLUNK_HOME/bin/splunk btool inputs list --debug|grep "your script name"
Once you find the script, you may execute them on your forwarder to verify the result by either using the absolute path or relative path.
For e.g. if your script is located in SPLUNK_HOME/etc/apps/my_app/bin/myscript.sh , you may run it using the entire path or
cd SPLUNK_HOME/etc/apps/my_app/bin/
./myscript.sh
where SPLUNK_HOME is your splunk installation directory
Reference:
Scripted Input:
[script://<cmd>]
* Runs <cmd> at a configured interval (see below) and indexes the output
that <cmd> returns.
* The <cmd> must reside in one of the following directories:
* $SPLUNK_HOME/etc/system/bin/
* $SPLUNK_HOME/etc/apps/$YOUR_APP/bin/
* $SPLUNK_HOME/bin/scripts/
* The path to <cmd> can be an absolute path, make use of an environment
variable such as $SPLUNK_HOME, or use the special pattern of an initial '.'
as the first directory to indicate a location inside the current app.
* The '.' specification must be followed by a platform-specific directory
separator.
* For example, on UNIX:
[script://./bin/my_script.sh]
Or on Windows:
[script://.\bin\my_program.exe]
This '.' pattern is strongly recommended for app developers, and necessary
for operation in search head pooling environments.
* <cmd> can also be a path to a file that ends with a ".path" suffix. A file
with this suffix is a special type of pointer file that points to a command
to be run. Although the pointer file is bound by the same location
restrictions mentioned above, the command referenced inside it can reside
anywhere on the file system. The .path file must contain exactly one line:
the path to the command to run, optionally followed by command-line
arguments. The file can contain additional empty lines and lines that begin
with '#'. The input ignores these lines.
Thank you @renjith.nair