Getting Data In

Windows Scripted Input specify index

Viorel
Explorer

I am probably overengineering this but this is the only way I could get a script to execute on UF, via a deployed application's bin folder 🙂

I have a .path file which executes powershell.exe -command "& 'path_to_ps1_script'" and it's placed, as stated, in myapp\bin\scripts folder

The PS1 script, returns a valid JSON.

The app's inputs.conf stanza:

[script://$SPLUNK_HOME\etc\apps\<my app>\bin\scripts\myscript.path]
disabled=false
interval=60
sourcetype=my_source_type
source=my_source
send_index_as_argument_for_path=false
index=my_index

As soon as I put index=my_index in my stanza, the data is not being indexed for some reason.

If I remove the index, the data is indexed into the default "main" index, however i'm looking for a solution to send that data to an index I specify

 

Any suggestions ?

 

Labels (1)
0 Karma
1 Solution

Viorel
Explorer

For some reason, deleting the index from the indexer server and then re-creating it, fixed the issue.

Thank you all for your suggestions

View solution in original post

Viorel
Explorer

For some reason, deleting the index from the indexer server and then re-creating it, fixed the issue.

Thank you all for your suggestions

matt8679
Path Finder

Remove these from the inputs.conf

source=my_source
send_index_as_argument_for_path=false

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Well... it should work so it's strange that it doesn't.

Do you have any related errors in _internal (from either your UF or your downstream idxs/HFs)?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does my_index exist on the indexers and is it the right type?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Viorel
Explorer

yes it does exist and it's of a right type ...

Forgot to mention, i'm using splunk 8.2.1

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...