Splunk Dev

How to pass a 'source path' to a script ?

jeswin96
Engager

I am monitoring a location in my system.Whenever there is any new file in the location,I call a script using unarchive command in props.conf .I want to pass the source path of the new file in the location to the script?

I am calling the script when there is a new file in my location using following configuration:

input.conf
[monitor://C:\location\*.*]
index=test

props.conf
[source::C:\\location\*.*]
invalid_cause=archive
unarchive_cmd = path_to_script\\scriptName.py

I know that I can pass arguments to script like following and access arguments as command line arguments in script:

props.conf
[source::C:\\location\*.*]
invalid_cause=archive
unarchive_cmd = path_to_script\\scriptName.py argument1 argument2

Please help me how to pass source path(the location of the new file,
which is triggering the call of script) to script.

Labels (1)
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Introducing .conf Stories Series!

“.conf Stories” Series – First Feature: Rich Mahlerwein   Every year .conf brings together some of the most ...