Getting Data In

manually run a scripted input?

Contributor

I have a scripted input in Splunk that sends it's data to Splunk via STDOUT. Is there any way to run the script on-demand and have the results sent to Splunk without restarting Splunk? Something like a "oneshot" cli method, but for scripted inputs, not for files.

0 Karma
Highlighted

Re: manually run a scripted input?

SplunkTrust
SplunkTrust

What OS are you running?

0 Karma
Highlighted

Re: manually run a scripted input?

Path Finder

If you write the output to a file in a sinkhole like, .../var/spool/splunk, then Splunk will consume it.
If you need the sourcetype to be the same as when it runs as a script then create a different sinkhole and specify the sourcetype

0 Karma
Highlighted

Re: manually run a scripted input?

Splunk Employee
Splunk Employee

or same idea with saving the result of the script to a file and monitor the file with the correct sourcetype.

then you will have to clean the result file once a while.

Highlighted

Re: manually run a scripted input?

Communicator

You can disable and again enable scripted input. This will make it run. It worked for me.

0 Karma
Highlighted

Re: manually run a scripted input?

SplunkTrust
SplunkTrust

You can do this, but splunk wont index the data necessarily: ./splunk cmd /opt/splunk/etc/apps/yourapp/bin/script.sh

You will see STDOUT/ERR from your script though

0 Karma