trying to read a script out using UF

[arunkuriakose]

Hi Splunkers

The idea is to pull any new file creations on a particular folder inside C:\users\<username>\appdata\local\somefolder

i wrote a batch script to pull and index this data. its working but the issue is i cannot define a token for users.

eg: In script if i mention the path as C:\users\<user1>\appdata\local the batch script will run as expected an data will be indexed to splunk but if i mention the user1 as %userprofile% or %localappdata% the batch script is not running. How to resolve this

[PickleRick]

You can expect Splunk to use environmental variables only in the cases documented in conf file specs. So if you want to use a variable's value you need to resolve the variable yourself within the script.

[arunkuriakose]

Hi @PickleRick 

thanks for the response

i tried something similar to this . I tried to fetch %userprofile% and saved it to a variable and then call the variable as part of another command but it didnt help. Can you give an example

[PickleRick]

You simply have to use the variable any way is appropriate for the programming/scripting solution you're using - powershell, python, whatever.

One important thing though - %USERPROFILE% in case of a scripted input run by splunkd.exe will at best point to Splunk Forwarder's technical user's profile. Is that what you want? Why not simply use the forwarder's SPLUNK_HOME variable then?