Splunk Dev

How to pass a 'source path' to a script ?

jeswin96
Engager

I am monitoring a location in my system.Whenever there is any new file in the location,I call a script using unarchive command in props.conf .I want to pass the source path of the new file in the location to the script?

I am calling the script when there is a new file in my location using following configuration:

input.conf
[monitor://C:\location\*.*]
index=test

props.conf
[source::C:\\location\*.*]
invalid_cause=archive
unarchive_cmd = path_to_script\\scriptName.py

I know that I can pass arguments to script like following and access arguments as command line arguments in script:

props.conf
[source::C:\\location\*.*]
invalid_cause=archive
unarchive_cmd = path_to_script\\scriptName.py argument1 argument2

Please help me how to pass source path(the location of the new file,
which is triggering the call of script) to script.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...