Getting Data In

Windows Scripted Input specify index

Viorel
Explorer

I am probably overengineering this but this is the only way I could get a script to execute on UF, via a deployed application's bin folder 🙂

I have a .path file which executes powershell.exe -command "& 'path_to_ps1_script'" and it's placed, as stated, in myapp\bin\scripts folder

The PS1 script, returns a valid JSON.

The app's inputs.conf stanza:

[script://$SPLUNK_HOME\etc\apps\<my app>\bin\scripts\myscript.path]
disabled=false
interval=60
sourcetype=my_source_type
source=my_source
send_index_as_argument_for_path=false
index=my_index

As soon as I put index=my_index in my stanza, the data is not being indexed for some reason.

If I remove the index, the data is indexed into the default "main" index, however i'm looking for a solution to send that data to an index I specify

 

Any suggestions ?

 

Labels (1)
0 Karma
1 Solution

Viorel
Explorer

For some reason, deleting the index from the indexer server and then re-creating it, fixed the issue.

Thank you all for your suggestions

View solution in original post

Viorel
Explorer

For some reason, deleting the index from the indexer server and then re-creating it, fixed the issue.

Thank you all for your suggestions

matt8679
Path Finder

Remove these from the inputs.conf

source=my_source
send_index_as_argument_for_path=false

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Well... it should work so it's strange that it doesn't.

Do you have any related errors in _internal (from either your UF or your downstream idxs/HFs)?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does my_index exist on the indexers and is it the right type?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Viorel
Explorer

yes it does exist and it's of a right type ...

Forgot to mention, i'm using splunk 8.2.1

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...