Getting Data In

Windows Scripted Input specify index

Viorel
Explorer

I am probably overengineering this but this is the only way I could get a script to execute on UF, via a deployed application's bin folder 🙂

I have a .path file which executes powershell.exe -command "& 'path_to_ps1_script'" and it's placed, as stated, in myapp\bin\scripts folder

The PS1 script, returns a valid JSON.

The app's inputs.conf stanza:

[script://$SPLUNK_HOME\etc\apps\<my app>\bin\scripts\myscript.path]
disabled=false
interval=60
sourcetype=my_source_type
source=my_source
send_index_as_argument_for_path=false
index=my_index

As soon as I put index=my_index in my stanza, the data is not being indexed for some reason.

If I remove the index, the data is indexed into the default "main" index, however i'm looking for a solution to send that data to an index I specify

 

Any suggestions ?

 

Labels (1)
0 Karma
1 Solution

Viorel
Explorer

For some reason, deleting the index from the indexer server and then re-creating it, fixed the issue.

Thank you all for your suggestions

View solution in original post

Viorel
Explorer

For some reason, deleting the index from the indexer server and then re-creating it, fixed the issue.

Thank you all for your suggestions

matt8679
Path Finder

Remove these from the inputs.conf

source=my_source
send_index_as_argument_for_path=false

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Well... it should work so it's strange that it doesn't.

Do you have any related errors in _internal (from either your UF or your downstream idxs/HFs)?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does my_index exist on the indexers and is it the right type?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Viorel
Explorer

yes it does exist and it's of a right type ...

Forgot to mention, i'm using splunk 8.2.1

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...