Getting Data In

pass hostname to scripted input

jgeyer14
Engager

Hi, I want to create a scripted input, a script that will query sql server on a machine. I want the query to be executed on whatever host I set up the input for, so I assume I should pass the hostname as an argument to the script. How can I do that dynamically? is there a variable in splunk that can expand automatically? So I could set splunk up to run the script something like this:

script.cmd $hostname

Tags (1)

jgeyer14
Engager

nevermind i figured it out. right now I am adding a new scripted input for each host and passing it manually like so:

first arg is the hostname the script will use to do the query

[script://$SPLUNK_HOME\bin\scripts\test.cmd testhost]
interval = 5
sourcetype = sql:test        
source = jamiesqltest
host=testhost
disabled=0


[script://$SPLUNK_HOME\bin\scripts\test.cmd testhost-2]
interval = 5
sourcetype = sql:test        
source = jamiesqltest
host=testhost-2
disabled=0
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...