Trying to run a batch file to add a log file to splunk. Works fine if I run it locally but not from a remote computer.
This is the line I'm having trouble with:
\\172.25.30.30\Splunk\bin\splunk.exe" add oneshot "\\172.25.30.30\shared\splunk\reports\name\Server.log"
I tried to add:
-hostname localhost.localdomain
or:
-auth admin:pass
But I still get the same error:
In handler 'oneshotinput': unable to open file: path='\\172.25.30.30\shared\splunk\reports\name\Server.log' error='Logon failure: unknown user name or bad password.'
admin and pass are the correct credentials to Splunk.
Anything I am missing?
Hi Javo222,
I just learned that the add oneshot
is run locally on the Splunk instance you're running it. This means this should be listed in the docs as well as not supported remote command.
@piebob and @ppablo_splunk could you please verify this and have the docs updated? Thanks 🙂
cheers, MuS
Hi Javo222,
I just learned that the add oneshot
is run locally on the Splunk instance you're running it. This means this should be listed in the docs as well as not supported remote command.
@piebob and @ppablo_splunk could you please verify this and have the docs updated? Thanks 🙂
cheers, MuS
just passed this on to our world class docteam! thank you, oh mighty SPAMHAMMER @MuS !
ahah at least now I know why it didn't work! thanks guys!
Docs are updated to mention this restriction!
Have you tried to use the default: "admin:changeme"?
normally you should uses the -uri https://splunkserver:8089
option if you want to use a remote cli command. See docs http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/AccessandusetheCLIonaremoteserver also did you enable remote access in server.conf
on the remote server?
I enabled remote access and changed to:
"C:\Program Files\Splunk\bin\splunk.exe" add oneshot "C:\Users\myuser\Documents\splunk_data\reports\name\Server.log" -uri http://172.25.30.30:8000
and I get "Not found" but I can't figure out what is not found. The path the the files is correct and tried to use remote path as well but no luck.
I'll check that tomorrow morning ....
I found another way to do it. copied the files to the remote server and use monitoring the folder. So I don't need the oneshot add anymore.