Splunk running script advice

[MHibbin]

Hi SplunkBase,

How do I make Splunk start a script (not as an input)? -the script generates log files which I can then monitor in Splunk. Or, is there a way of making the script run as an input continuously (i.e. not running on intervals)?

Basically, I want the script to run when ever Splunk is, and would rather not add an entry to cron (making it safer when distributing in an environment).

Any advice welcome on best practices.

Regards,

MHibbin

[Drainy · Accepted solution]

I believe if you set it as a scripted input with an interval of -1 (via config only, GUI won't accept a -1 value) then Splunk will keep it running and restart it if it isn't running.
As long as it is only doing file output then Splunk won't have anything to index from it and it can happily generate log data. Saying that you might find it worthwhile generating some stdoutput from it for logging purposes (direct it to _internal for debugging your script)

[MHibbin]

Yeah this appears to be working. Thanks for the answer.

[DUThibault]

What if you a) want the script to run just once and b) don't want to actually import the script's output? This happens if, for instance, one is managing a Splunk single-instance server remotely and need to run an app's setup script (e.g. the Splunk Reference App - PAS from Splunkbase needs its bin/install-addons.sh to be run).

[MHibbin]

Thanks for getting back to me. I'll give this a try.

Thanks for the suggestion about stdout, I have already set up info/error codes for this though. 🙂