Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- splunk-perfmon.path (sic?)
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
As I'm installing TA's on windows hosts, I see that the PerformanceMonitor source is specified as
[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]
The file itself is called splunk-perfmon.exe. Is this intentional - as in disabling accidental usage of the exe, a Splunk trick or a typo?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I dont think its a trick or a typo. Its very similar to having a bat or sh file referance another path and excutable. If you notice that scripted input referances [script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path] and splunk-perfmon.path referances $SPLUNK_HOME\bin\splunk-perfmon.exe. I've seen this done in a few TAs.
You could enter the splunk-perfmon.exe path directly, but you have have a script change the return data or formatting with your script. I think scripted inputs are done this way for consistancy when referancing executables.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I dont think its a trick or a typo. Its very similar to having a bat or sh file referance another path and excutable. If you notice that scripted input referances [script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path] and splunk-perfmon.path referances $SPLUNK_HOME\bin\splunk-perfmon.exe. I've seen this done in a few TAs.
You could enter the splunk-perfmon.exe path directly, but you have have a script change the return data or formatting with your script. I think scripted inputs are done this way for consistancy when referancing executables.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, it is indeed not a typo or trick. I was staring myself blind at the splunk-perfmon.exe in $SPLUNK_HOME/bin and did not see that the conf actually points to the subdirectory scripts, which includes the .path-scripts.
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
