Where on a Windows machine should I store logs generated from custom scripts for Splunk Universal Forwarder to forward?

[landen99]

Running a log-generating script locally on a Windows machine with a Splunk UF, I am looking for best practices for where to store the script log files. I imagine that there may be permissions issues with trying to store them under a user account or in the Windows directory. Splunk will run the custom script either periodically or constantly.

[Jeremiah · Accepted solution]

If you are using Splunk to run the script, you should store the scripts in a Splunk app:

http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ScriptedInputsIntro

Place scripts in the bin directory of your app:

$SPLUNK_HOME/etc/apps/<appname>/bin/

If you have Splunk run the scripts as inputs, you don't need to generate log files. Splunk will read the script output and forward it to your indexers.