Windows Scripted Input specify index

[Viorel]

I am probably overengineering this but this is the only way I could get a script to execute on UF, via a deployed application's bin folder 🙂

I have a .path file which executes powershell.exe -command "& 'path_to_ps1_script'" and it's placed, as stated, in myapp\bin\scripts folder

The PS1 script, returns a valid JSON.

The app's inputs.conf stanza:

[script://$SPLUNK_HOME\etc\apps\<my app>\bin\scripts\myscript.path]
disabled=false
interval=60
sourcetype=my_source_type
source=my_source
send_index_as_argument_for_path=false
index=my_index

As soon as I put index=my_index in my stanza, the data is not being indexed for some reason.

If I remove the index, the data is indexed into the default "main" index, however i'm looking for a solution to send that data to an index I specify

Any suggestions ?

[Viorel · Accepted solution]

For some reason, deleting the index from the indexer server and then re-creating it, fixed the issue.

Thank you all for your suggestions

[matt8679]

Remove these from the inputs.conf

source=my_source
send_index_as_argument_for_path=false

[PickleRick]

Well... it should work so it's strange that it doesn't.

Do you have any related errors in _internal (from either your UF or your downstream idxs/HFs)?

[richgalloway]

Does my_index exist on the indexers and is it the right type?

[Viorel]

yes it does exist and it's of a right type ...

Forgot to mention, i'm using splunk 8.2.1