Splunk Enterprise

Though I have my script in place in the directory, why is the data input wizard stating: "No Scripts found under the selected path"

securityforward
New Member

Hello,

I have a universal forwarder installed on Mac OS X and am unable to configure data input to use a script. The script is in place in the directory with the proper permissions, but the data input wizard states that "No Scripts found under the selected path.".

Any ideas?

alt text

0 Karma

whrg
Motivator

Hi! There are basically two ways to configure a Universal Forwarder: Either 1) by using the CLI or configuration files directly on the Universal Forwarder or by 2) using a deployment server.

I suppose you want to use a deployment server. In this case, the deployment server will distribute the configuration (including scripts) to the Universal Forwarder. When creating a new Forwarded Script Input via the deployment server's web GUI then you need to place the script on your deployment server (not on your Universal Forwarder as seen in your screenshot) in $SPLUNK_HOME/bin/scripts. The script will then get transferred to the Universal Forwarder as part of the Server Class.

0 Karma

securityforward
New Member

Hello! Thanks for the reply. This really clears some things up. What if you are running Splunk Light in the cloud. If the instance is in the cloud how does one access it to create/modify/upload different deployment items?

Thanks!

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@securityforward, try adding it to the "splunk installation directory"/bin/scripts

Happy Splunking!
0 Karma

securityforward
New Member

Thanks for the response! In the CLI screenshot on the right, it shows the path as "/Applications/SplunkForwarder/bin/scripts" which should be the splunk installation directory.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Ok, check if the SPLUNK_HOME is set properly to the installation directory and also the SPLUNK user has permission to the folder structure not only the file

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...