Splunk Dev

How to pass a 'source path' to a script ?

jeswin96
Engager

I am monitoring a location in my system.Whenever there is any new file in the location,I call a script using unarchive command in props.conf .I want to pass the source path of the new file in the location to the script?

I am calling the script when there is a new file in my location using following configuration:

input.conf
[monitor://C:\location\*.*]
index=test

props.conf
[source::C:\\location\*.*]
invalid_cause=archive
unarchive_cmd = path_to_script\\scriptName.py

I know that I can pass arguments to script like following and access arguments as command line arguments in script:

props.conf
[source::C:\\location\*.*]
invalid_cause=archive
unarchive_cmd = path_to_script\\scriptName.py argument1 argument2

Please help me how to pass source path(the location of the new file,
which is triggering the call of script) to script.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...