Hi,
As I'm installing TA's on windows hosts, I see that the PerformanceMonitor source is specified as
[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]
The file itself is called splunk-perfmon.exe
. Is this intentional - as in disabling accidental usage of the exe, a Splunk trick or a typo?
I dont think its a trick or a typo. Its very similar to having a bat or sh file referance another path and excutable. If you notice that scripted input referances [script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path] and splunk-perfmon.path referances $SPLUNK_HOME\bin\splunk-perfmon.exe. I've seen this done in a few TAs.
You could enter the splunk-perfmon.exe path directly, but you have have a script change the return data or formatting with your script. I think scripted inputs are done this way for consistancy when referancing executables.
I dont think its a trick or a typo. Its very similar to having a bat or sh file referance another path and excutable. If you notice that scripted input referances [script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path] and splunk-perfmon.path referances $SPLUNK_HOME\bin\splunk-perfmon.exe. I've seen this done in a few TAs.
You could enter the splunk-perfmon.exe path directly, but you have have a script change the return data or formatting with your script. I think scripted inputs are done this way for consistancy when referancing executables.
Yes, it is indeed not a typo or trick. I was staring myself blind at the splunk-perfmon.exe
in $SPLUNK_HOME/bin
and did not see that the conf actually points to the subdirectory scripts
, which includes the .path
-scripts.