How to correctly setup scripted (bash script) on forwarded input (UF) in HF via CLI or configuration?

[hamidseleman]

Hi,
I've been googling for weeks but to no avail on how to correctly setup scripted input on HF to massage input forwarded from UF.
Following is simple setup for inputs:

inputs.conf in UF
[monitor:///path-to-log/file.txt]
sourcetype = mysourcetype
index = myindex
crcSalt = <SOURCE>
disabled = false

inputs.conf in HF
[script://./bin/scripts/massager.sh]
sourcetype = mysourcetype
index = myindex
interval = 60.0
disabled = false

Sample setup or link highly appreciated.

Thanks.

[adonio]

hello there,

can you please elaborate?
what is it that you are trying to achieve?
you dont need any script on HF to send data that is coming from the UF, only configure inputs and outputs

[hamidseleman]

Hi,
I am trying to massage raw log sourced at UF by running script at HF before handing off data to Indexer. I dont want to run script at UF end. This is to free up UF from additional processing requirement.

[jkat54]

You’ll have to “massage” the data using props and transforms on the HF and possibly the UF.

See this article: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

[hamidseleman]

Thanks but for some reason I need to work with scripts.

[adonio]

@hamidseleman
i am not sure what exactly you are trying to achieve and why would you have to work with scripts.
you can massage the raw data from the UF at the HF using props and transforms.

[hamidseleman]

Hi,
what i am trying to achieve mostly is already stated exactly in the question itself. Anyway, thanks.