Splunk Search

Is there any way to execute a linux query and fetch the results of it in the Splunk search board?

Andreww
New Member

Hi,

Is there any way to execute a linux query and fetch the results of it in the Splunk search board?

Following this I have written a condition to send an alert based on the command output.

Labels (1)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, it can be done.  Use a scripted input to execute the Linux command and the results will be indexed automatically.  Have a look at the Splunk Add-on for Unix and Linux (Splunk_TA_nix) at https://splunkbase.splunk.com/app/833 for examples.   It collects data the way you describe.  Once the data is collected and indexed then you can write an alert for it.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...