Getting Data In
Highlighted

manually run a scripted input?

Contributor

I have a scripted input in Splunk that sends it's data to Splunk via STDOUT. Is there any way to run the script on-demand and have the results sent to Splunk without restarting Splunk? Something like a "oneshot" cli method, but for scripted inputs, not for files.

0 Karma
Highlighted

Re: manually run a scripted input?

SplunkTrust
SplunkTrust

What OS are you running?

0 Karma
Highlighted

Re: manually run a scripted input?

Path Finder

If you write the output to a file in a sinkhole like, .../var/spool/splunk, then Splunk will consume it.
If you need the sourcetype to be the same as when it runs as a script then create a different sinkhole and specify the sourcetype

0 Karma
Highlighted

Re: manually run a scripted input?

Ultra Champion

or same idea with saving the result of the script to a file and monitor the file with the correct sourcetype.

then you will have to clean the result file once a while.

Highlighted

Re: manually run a scripted input?

Communicator

You can disable and again enable scripted input. This will make it run. It worked for me.

0 Karma
Highlighted

Re: manually run a scripted input?

SplunkTrust
SplunkTrust

You can do this, but splunk wont index the data necessarily: ./splunk cmd /opt/splunk/etc/apps/yourapp/bin/script.sh

You will see STDOUT/ERR from your script though

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.