Getting Data In

Scripted input question for batch file

sieutruc
Contributor

Hello,
I cannot get the value of scripted input by using batch file as wrapper script. My configuration is as below:
MemoryPerf.bat and counters.exe in etc\system\bin

@ECHO OFF 

counters.exe 6 Memory "Page Faults/sec" "%% Committed Bytes In Use" "Committed Bytes" "Pages/sec" "Available MBytes"

Inputs.conf in etc\system\local

[script://$SPLUNK_HOME\etc\system\bin\MemoryPerf.bat]
interval = 6
index = default
source = cript://MemoryPerf.bat
disabled = 0

But after that, it didn't work. i opened task manager and did't see the counters instance in the list too. Do you know what wrong i did ?

Tags (1)
0 Karma
1 Solution

adamw
Communicator

Your source= might be causing an issue. By default, Splunk will set up the source value to $SPLUNK_HOME\etc\system\bin\MemoryPerf.bat, I would comment out this line and see if it starts working.

Also, take a look at $SPLUNK_HOME\var\log\splunk\splunkd.log, and it should tell you if the script is actually executing or not. You can also run $SPLUNK_HOME\bin\splunk cmd btool inputs list to see if you can find your script listed, as this will indicate if the configuration is correct.

View solution in original post

sieutruc
Contributor

I have already found the solution. Intuitively, i guess that Splunk, when it runs, it will set the current directory for batch file as C:\Windows\system32 to get cmd.exe. So in order to change back to the current place where the batch file is being stored, we use a small trick and put it at the beginning of the batch script as

@ECHO OFF

cd /d %~dp0

[your script at the same folder as batch file]

Thanks for your suggestion about splunkd.log.

adamw
Communicator

Your source= might be causing an issue. By default, Splunk will set up the source value to $SPLUNK_HOME\etc\system\bin\MemoryPerf.bat, I would comment out this line and see if it starts working.

Also, take a look at $SPLUNK_HOME\var\log\splunk\splunkd.log, and it should tell you if the script is actually executing or not. You can also run $SPLUNK_HOME\bin\splunk cmd btool inputs list to see if you can find your script listed, as this will indicate if the configuration is correct.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...