Static File Ingestion to Splunk

[b17gunnr]

Hello Friends,

I have what might be considered a strange request. I have a static unbound.conf file living on a dns server whose contents I'm being asked to ingest into Splunk for a variety of reasons. The UF does have a functioning UF installed on it and I am receiving events from a handful of monitored files without issue. The question I have is would this work as scripted below? Naturally it isn't right now so here I am. Any thoughts? Thank you.

---------------------------------------------------------------------------------

Add to /opt/splunkforwarder/etc/system/local/inputs.conf:

[script:///opt/splunkforwarder/etc/system/local/bin/read_unbound_conf.sh]
sourcetype = secure_name_resolution
index = dns
interval = 86400
disabled = 0

Add to /opt/splunkforwarder/etc/system/local/props.conf:

[secure_name_resolution]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=server=)
TRUNCATE = 1000000
DATETIME_CONFIG = CURRENT

Create /opt/splunkforwarder/etc/system/local/bin/read_unbound_conf.sh:

bash
#!/bin/bash
echo "server=$(hostname)"
cat /etc/unbound/unbound.conf

chmod +x /opt/splunkforwarder/etc/system/local/bin/read_unbound_conf.sh
Restart UF

[PickleRick]

This doesn't make much sense. Why not just monitor the file? Noone prohibits you from reading a static file.

[b17gunnr]

Monitoring the file does not meet the fundamental requirement of the ask. This is part of an attempt to automate the collection of compliance and audit evidence via Splunk. In this case, the regulatory body requires copies of this file from the source system. If we are able to automate the collection process through Splunk I'd be able to schedule a report for them and free up an Engineer's time.

[PickleRick · Accepted solution]

Ah, so you're not interested in the contents of the file as such but rather want to use (one could say abuse ;-)) the UF to periodically record contents of the file, right?

Yes, spawning a scripted input with a give schedule should give you that result.

You must remember though that once you set up this "automation" you have to monitor it somehow - both where the task wasn't spawned as well as when it encountered some errors and might have produced bad results.

EDIT: And two more things.

1. Don't hardcode full paths to your UF installation. Use $SPLUNK_HOME as base

2. Don't put it in system/local. Make an app with local/input.con and bin/your.script.sh and push it to your UF(s)