Getting Data In

Splunk running script advice

MHibbin
Influencer

Hi SplunkBase,

How do I make Splunk start a script (not as an input)? -the script generates log files which I can then monitor in Splunk. Or, is there a way of making the script run as an input continuously (i.e. not running on intervals)?

Basically, I want the script to run when ever Splunk is, and would rather not add an entry to cron (making it safer when distributing in an environment).

Any advice welcome on best practices.

Regards,

MHibbin

0 Karma
1 Solution

Drainy
Champion

I believe if you set it as a scripted input with an interval of -1 (via config only, GUI won't accept a -1 value) then Splunk will keep it running and restart it if it isn't running.
As long as it is only doing file output then Splunk won't have anything to index from it and it can happily generate log data. Saying that you might find it worthwhile generating some stdoutput from it for logging purposes (direct it to _internal for debugging your script)

View solution in original post

Drainy
Champion

I believe if you set it as a scripted input with an interval of -1 (via config only, GUI won't accept a -1 value) then Splunk will keep it running and restart it if it isn't running.
As long as it is only doing file output then Splunk won't have anything to index from it and it can happily generate log data. Saying that you might find it worthwhile generating some stdoutput from it for logging purposes (direct it to _internal for debugging your script)

MHibbin
Influencer

Yeah this appears to be working. Thanks for the answer.

0 Karma

DUThibault
Contributor

What if you a) want the script to run just once and b) don't want to actually import the script's output? This happens if, for instance, one is managing a Splunk single-instance server remotely and need to run an app's setup script (e.g. the Splunk Reference App - PAS from Splunkbase needs its bin/install-addons.sh to be run).

0 Karma

MHibbin
Influencer

Thanks for getting back to me. I'll give this a try.

Thanks for the suggestion about stdout, I have already set up info/error codes for this though. 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...