Getting Data In

Scripted Input - Windows Indexer - Linux Host

New Member

Looking for the best way to collect Disk Free Space from a Linux box to a Windows Indexer. Company policy wont let me put a light weight forwarder on the host.

Would like to collect the output from a "df -h" and run this every x period of time and have the input collected into Splunk.

I know I need to run some Scripted Input from the host, but how will this work from a Windows Indexer?

Indexer - Windows 2003 Server Linux - Red Hat

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Just curious what issue the company has with the light weight forwarder? Are there any changes Splunk can make to the LWF to make it compliant?

Anyway, here are a few ideas:

  • .bat scripted input that uses ssh to login to Linux and execute the df -h command. You'd have to install a CLI friendly ssh client on the Windows box. I'd also recommend distributing keys rather than hard-coding credentials in the script.
  • same kind of scripted input as above, but using snmp polling. Much more light-weight. Look at something like Cacti.
  • you can samba mount the disk and use Windows' native methods such as perf counters. Probably the fastest but least production-ready solution.
  • Would company policy allow you to put your own cron script on the Linux box that runs df -h | netcat?

Super Champion

Additional suggestion based Dan's 1st suggestion. Rather than using df -h, you could use the script that's bundled in the unix app's bin folder (if you allowed to place that on the linux machine). I think you could use the plink tool in that comes with Putty (ssh client for windows). You could also use the Putty Agent to store ssh keys for the whole auth thing.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...