How to assign actual directory source in script

[mukhan1]

Hi Community,

I'm working on script input. I have created a script to convert binary code logs into human read-able format and it is working fine. Now the issue is the file im monitoring is in "/var/log/test" directory. 

The script is in "/opt/splunk/etc/apps/testedScript/bin/testedscript.sh" directory. I'm getting script address as source in Splunk. Attaching screenshot as reference. 

below is my inputs.conf stanza I'm using (/opt/splunk/etc/apps/testScript/local/inputs.conf):

[script:///opt/splunk/etc/apps/testScript/bin/testedScript.sh]
disabled=false
index=testing
interval=30
sourcetype=free2

Is there anyway i can get exact source address like in my case it is "/var/log/test/file1"

[PickleRick]

Since data from scripted input is ingested "as is", you really have two and a half choices.

1. Sent the metadata about the file being read by your script as part of your event (if it's not needed in the event itself you should then parse it out from the event with props/transforms into the source field or any other indexed field and possibly remove it from the _raw message.

2. You could use the HEADER_MODE setting to dynamically insert metadata into your event stream (but that's actually not that much different from point 1 since you'd have to insert it with every single event. And it's a very unusual configuration option so it might be difficult to maintain.

3. That's the half-choice since it requires you to change the approach to the ingestion process - rewrite your script so that it does what it does but sends it to an HEC /data endpoint and run it independently from your Splunk instance. This way you can easily manipulate additional fields freely.

[richgalloway]

The inputs.conf stanza tells Splunk to run your script.  What the script does depends on how it is written.  It may want to get the files it should read from a script-specific configuration file.