Getting Data In

Splunk is not Indexing Scripted Input Data

rsantoso_splunk
Splunk Employee
Splunk Employee

Splunk is not indexing the data through the Scripted input.

The input is working for the on-premise servers, the data input is through a universal forwarder. The same setup being configured, however, it is not working for the new host.

Tags (1)
0 Karma
1 Solution

rsantoso_splunk
Splunk Employee
Splunk Employee

1.) To list the non-internal indexes and non-internal indexes

a. To list of all non-internal indexes:
| eventcount summarize=false index=* | dedup index | fields index

b. To list of all sourcetype within the non-internal indexes:
| tstats count where index=* by index, sourcetype

2.) inputs.conf

a. The configuration for scripts needs to be in formatted with script rather than monitor
b. The script need to be located at the $SPLUNK_HOME/bin/scripts
Example:
[script:///opt/splunkforwarder/bin/scripts/client-stats.sh]

3.) The scripts need the environment setup and the jar file to run.
Copy the setup env file and the jar file to the $SPLUNK_HOME/bin/scripts.
Change the permission and ownership of the file accordingly.

View solution in original post

0 Karma

rsantoso_splunk
Splunk Employee
Splunk Employee

1.) To list the non-internal indexes and non-internal indexes

a. To list of all non-internal indexes:
| eventcount summarize=false index=* | dedup index | fields index

b. To list of all sourcetype within the non-internal indexes:
| tstats count where index=* by index, sourcetype

2.) inputs.conf

a. The configuration for scripts needs to be in formatted with script rather than monitor
b. The script need to be located at the $SPLUNK_HOME/bin/scripts
Example:
[script:///opt/splunkforwarder/bin/scripts/client-stats.sh]

3.) The scripts need the environment setup and the jar file to run.
Copy the setup env file and the jar file to the $SPLUNK_HOME/bin/scripts.
Change the permission and ownership of the file accordingly.

0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...