Hello,
I cannot get the value of scripted input by using batch file as wrapper script. My configuration is as below:
MemoryPerf.bat and counters.exe in etc\system\bin
@ECHO OFF
counters.exe 6 Memory "Page Faults/sec" "%% Committed Bytes In Use" "Committed Bytes" "Pages/sec" "Available MBytes"
Inputs.conf in etc\system\local
[script://$SPLUNK_HOME\etc\system\bin\MemoryPerf.bat]
interval = 6
index = default
source = cript://MemoryPerf.bat
disabled = 0
But after that, it didn't work. i opened task manager and did't see the counters instance in the list too. Do you know what wrong i did ?
Your source=
might be causing an issue. By default, Splunk will set up the source value to $SPLUNK_HOME\etc\system\bin\MemoryPerf.bat
, I would comment out this line and see if it starts working.
Also, take a look at $SPLUNK_HOME\var\log\splunk\splunkd.log
, and it should tell you if the script is actually executing or not. You can also run $SPLUNK_HOME\bin\splunk cmd btool inputs list
to see if you can find your script listed, as this will indicate if the configuration is correct.
I have already found the solution. Intuitively, i guess that Splunk, when it runs, it will set the current directory for batch file as C:\Windows\system32 to get cmd.exe. So in order to change back to the current place where the batch file is being stored, we use a small trick and put it at the beginning of the batch script as
@ECHO OFF
cd /d %~dp0
[your script at the same folder as batch file]
Thanks for your suggestion about splunkd.log.
Your source=
might be causing an issue. By default, Splunk will set up the source value to $SPLUNK_HOME\etc\system\bin\MemoryPerf.bat
, I would comment out this line and see if it starts working.
Also, take a look at $SPLUNK_HOME\var\log\splunk\splunkd.log
, and it should tell you if the script is actually executing or not. You can also run $SPLUNK_HOME\bin\splunk cmd btool inputs list
to see if you can find your script listed, as this will indicate if the configuration is correct.