Getting Data In

How do I run a shell script in a universal forwarder?

raj_mpl
Path Finder

I have a problem here. My shell script is not giving the complete output in the Splunk search head . What is the command to check and run the script in the UF?

0 Karma
1 Solution

renjith_nair
Legend

@raj_mpl ,

If you are referring to the scripted inputs , then most likely it should be part of an app. To find the location of the script, use btool and list all the inputs

SPLUNK_HOME/bin/splunk btool inputs list --debug|grep "your script name"

Once you find the script, you may execute them on your forwarder to verify the result by either using the absolute path or relative path.

For e.g. if your script is located in SPLUNK_HOME/etc/apps/my_app/bin/myscript.sh , you may run it using the entire path or

cd SPLUNK_HOME/etc/apps/my_app/bin/
./myscript.sh

where SPLUNK_HOME is your splunk installation directory

Reference:

Scripted Input:

[script://<cmd>]
* Runs <cmd> at a configured interval (see below) and indexes the output
  that <cmd> returns.
* The <cmd> must reside in one of the following directories:
  * $SPLUNK_HOME/etc/system/bin/
  * $SPLUNK_HOME/etc/apps/$YOUR_APP/bin/
  * $SPLUNK_HOME/bin/scripts/
* The path to <cmd> can be an absolute path, make use of an environment
  variable such as $SPLUNK_HOME, or use the special pattern of an initial '.'
  as the first directory to indicate a location inside the current app.
* The '.' specification must be followed by a platform-specific directory
  separator.
  * For example, on UNIX:
        [script://./bin/my_script.sh]
    Or on Windows:
        [script://.\bin\my_program.exe]
    This '.' pattern is strongly recommended for app developers, and necessary
    for operation in search head pooling environments.
* <cmd> can also be a path to a file that ends with a ".path" suffix. A file
  with this suffix is a special type of pointer file that points to a command
  to be run. Although the pointer file is bound by the same location
  restrictions mentioned above, the command referenced inside it can reside
  anywhere on the file system. The .path file must contain exactly one line:
  the path to the command to run, optionally followed by command-line
  arguments. The file can contain additional empty lines and lines that begin
  with '#'. The input ignores these lines.
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@raj_mpl ,

If you are referring to the scripted inputs , then most likely it should be part of an app. To find the location of the script, use btool and list all the inputs

SPLUNK_HOME/bin/splunk btool inputs list --debug|grep "your script name"

Once you find the script, you may execute them on your forwarder to verify the result by either using the absolute path or relative path.

For e.g. if your script is located in SPLUNK_HOME/etc/apps/my_app/bin/myscript.sh , you may run it using the entire path or

cd SPLUNK_HOME/etc/apps/my_app/bin/
./myscript.sh

where SPLUNK_HOME is your splunk installation directory

Reference:

Scripted Input:

[script://<cmd>]
* Runs <cmd> at a configured interval (see below) and indexes the output
  that <cmd> returns.
* The <cmd> must reside in one of the following directories:
  * $SPLUNK_HOME/etc/system/bin/
  * $SPLUNK_HOME/etc/apps/$YOUR_APP/bin/
  * $SPLUNK_HOME/bin/scripts/
* The path to <cmd> can be an absolute path, make use of an environment
  variable such as $SPLUNK_HOME, or use the special pattern of an initial '.'
  as the first directory to indicate a location inside the current app.
* The '.' specification must be followed by a platform-specific directory
  separator.
  * For example, on UNIX:
        [script://./bin/my_script.sh]
    Or on Windows:
        [script://.\bin\my_program.exe]
    This '.' pattern is strongly recommended for app developers, and necessary
    for operation in search head pooling environments.
* <cmd> can also be a path to a file that ends with a ".path" suffix. A file
  with this suffix is a special type of pointer file that points to a command
  to be run. Although the pointer file is bound by the same location
  restrictions mentioned above, the command referenced inside it can reside
  anywhere on the file system. The .path file must contain exactly one line:
  the path to the command to run, optionally followed by command-line
  arguments. The file can contain additional empty lines and lines that begin
  with '#'. The input ignores these lines.
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

raj_mpl
Path Finder

Thank you @renjith.nair

0 Karma
Get Updates on the Splunk Community!

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...

New This Month in Splunk Observability Cloud - Synthetic Monitoring updates, UI ...

This month, we’re delivering several platform, infrastructure, application and digital experience monitoring ...