I'm trying to find out if it is possible to directly upload an event to the splunk server via an http/tcp interface without using a splunk agent.
Here's what I'm trying to do:
I'd like to be able to use splunk as the central repository for all my script outputs for hosts in my environment. Not all hosts will have a splunk agent/forwarder installed, and since these will be one off scripts, splunk doing WMI queries on these hosts doesn't help. All of the script outputs would have a very simple format, i.e. timestamp, hostname, script ID, and script result (i.e. SUCCESS - System Rebooting). From looking at other questions on the forums, it looks like a work around would be to have all of the hosts append the logs to a log file on a central logging server, and then have the agent on that server to forward it to splunk. That is an okay work around, but to cut out the middle man, I'd really like to just be able to just add a simple function to my script to have it be able to tell the splunk server about the script completion results. For other hosts in the environment we have splunk collecting the event logs, and custom app logs, but I'm just looking for a very lightweight way of having splunk capture custom script results. Oh, and the scripts would be triggered from separate scripting hosts, or from the system itself, so not something that would be ran directly from a splunk server where it would see the script results directly. The end result would allow me to have a section in a script that could be run against any host in my environment, and have it be able to add an entry to splunk (preferable over an http interface) without it needing to have any splunk client/forwarder pre-installed. Is this do-able? Hosts will mainly be Windows servers for now.
