Getting Data In

script input not working when parameter is passed as a variable and not the static value in inputs.conf

Explorer

Hi All,

I am using a script to fetch http response as splunk raw event. For this I am passing parameter as a variable, whose value is in another conf file.
The inputs.conf is as below:

[script:///opt/splunkforwarder/etc/apps/search/bin/scripts/urlhealthcheck.sh HEALTHCHECK_URL ]
sourcetype = healthcheck
disabled = false
interval = 300
index = main

The configuration file where the parameter HEALTHCHECK_URL is stored;example.conf

HEALTHCHECK_URL=https://healthcheckurl.domain.com

The shell script urlhealthcheck.sh;

#!/bin/sh
url=$(cat PRA.conf | grep $1 | awk -F "=" '{print $2}')
responsecode=$(wget -S --spider --no-check-certificate $url 2>&1 | grep "HTTP/" | awk '{print $2}')
response=$(wget -q --no-check-certificate -O - $url 2>&1 )
echo "URL=$url, ResponseCode=$responsecode, Response=$response"

This shell script is running perfectly when run from the terminal as

sh /opt/splunkforwarder/etc/apps/search/bin/scripts/urlhealthcheck.sh HEALTHCHECK_URL

Or run as

./opt/splunkforwarder/etc/apps/search/bin/scripts/urlhealthcheck.sh HEALTHCHECK_URL

giving output as ;
[
{
"code": 200,
"response": "Health Check: Succeeded"
}
]

But in inputs.conf this giving the response as ;
wget: missing URL
Usage: wget [OPTION]... [URL]...
Try `wget --help' for more options.

If I change the parameter from HEALTHCHECK_URL to https://healthcheckurl.domain.com as the http response is coming out correct without an error.

[script:///opt/splunkforwarder/etc/apps/search/bin/scripts/urlhealthcheck.sh https://healthcheckurl.domain.com ]
sourcetype = healthcheck
disabled = false
interval = 300
index = main

What is the reason that I am not able to pass the parameter as a variable through the inputs.conf, though the script is working fine?

0 Karma
1 Solution

Ultra Champion

where is "PRA.conf" located.
Scripts do not execute with ./app/bin as the working directory.
Its probable therefore that PRA.conf is not being found, and thus not expanded.

Can you try specifying the path fully in the script?
url=$(cat /opt/splunkforwarder/etc/apps/search/bin/scripts/PRA.conf | grep $1 | awk -F "=" '{print $2}')

View solution in original post

0 Karma

Ultra Champion

where is "PRA.conf" located.
Scripts do not execute with ./app/bin as the working directory.
Its probable therefore that PRA.conf is not being found, and thus not expanded.

Can you try specifying the path fully in the script?
url=$(cat /opt/splunkforwarder/etc/apps/search/bin/scripts/PRA.conf | grep $1 | awk -F "=" '{print $2}')

View solution in original post

0 Karma

Explorer

Thankyou. It is working

0 Karma

Ultra Champion

Great news!, Please accept my answer so others can see what the solution was in the furture!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!