- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Using a shell script to collect data on a universal forwarder, what do I need to configure in inputs and outputs.conf?
athorat
Communicator
09-01-2015
03:19 PM
Universal Forwarder-> Heavy Forwarder -> Indexer
We have a universal forwarder which is sitting on a different domain from where we want to collect data using a shell script.
Using the UI, I uploaded the shell script on the universal forwarder. How do I configure what data to send to the indexer?
As I have uploaded the shell using UI on the universal forwarder, do I need to configure the inputs.conf again?
What would be the settings/parameters on both the inputs.conf on the UF and HF
and also the outputs.conf?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

FritzWittwer_ol
Contributor
09-02-2015
06:53 AM
You have to configure inputs.conf,
[script://<script>]
interval=60
60 seconds is the default value for interval, and you can use the usual attributes like index, sourcetype, disabled.
see http://docs.splunk.com/Documentation/Splunk/6.2.5/Data/Setupcustominputs
