Getting Data In

is it possible to set up a scripted input that does its own sleeps and never exits?

sideview
SplunkTrust
SplunkTrust

There's a scripted input that I wanted to create a while ago, but it had to do some 'setup' stuff at the beginning and this setup stuff took longer than the schedule I needed to run the script on. Naturally this was problematic.

We tried briefly having the script just sleep periodically and then go back to returning data. However ExecProcessor didnt seem to like this arrangement. Specifically, none of the data we were returning out of stdout would get indexed into splunk until the script was actually killed. Is that the way it's supposed to work? This was a windows .bat file as the scripted input, and it was on Splunk 4.1.5.

So assuming I'm not crazy and by default the data doesnt get indexed until the script terminates, is there then any way in 4.1.5 or the upcoming 4.2 perhaps to have a scripted input that is constantly running and returning data rather than running on a schedule?

Ideally such a script would get somewhat managed by the ExecProcessor, ie restarted if it ever did terminate or get killed.

Tags (1)
0 Karma

bfaber
Communicator

I believe that if you set interval=0 the script will run in 'stream' mode, feeding splunk as it writes to stdout. This may work for you in the situation...

sideview
SplunkTrust
SplunkTrust

Nice! I totally missed this answer. We ended up going a completely different route on the app but I'll give it a shot.

0 Karma