Splunk Search

Pass arguments for shell script in inputs.conf?

ansif
Motivator

How to pass arguments to a script from inputs.conf?

example:
shell_script.sh server1 server2

Tags (1)
0 Karma

PavelP
Motivator

Hello @ansif

you cannot use parameters in the script stanza. Insted you should use .path format, which is more flexible:

[script://<cmd>]
* Runs <cmd> at a configured interval (see below) and indexes the output
  that <cmd> returns.
* The <cmd> must reside in one of the following directories:
  * $SPLUNK_HOME/etc/system/bin/
  * $SPLUNK_HOME/etc/apps/$YOUR_APP/bin/
  * $SPLUNK_HOME/bin/scripts/
* The path to <cmd> can be an absolute path, make use of an environment
  variable such as $SPLUNK_HOME, or use the special pattern of an initial '.'
  as the first directory to indicate a location inside the current app.
* The '.' specification must be followed by a platform-specific directory
  separator.
  * For example, on UNIX:
        [script://./bin/my_script.sh]
    Or on Windows:
        [script://.\bin\my_program.exe]
    This '.' pattern is strongly recommended for app developers, and necessary
    for operation in search head pooling environments.
* <cmd> can also be a path to a file that ends with a ".path" suffix. A file
  with this suffix is a special type of pointer file that points to a command
  to be run. Although the pointer file is bound by the same location
  restrictions mentioned above, the command referenced inside it can reside
  anywhere on the file system. The .path file must contain exactly one line:
  the path to the command to run, optionally followed by command-line
  arguments. The file can contain additional empty lines and lines that begin
  with ''. The input ignores these lines.
0 Karma

to4kawa
Ultra Champion

You can write as it is

0 Karma

ansif
Motivator

Thanks @to4kawa to confirm.

One additional question, can we keep one single addon and enable inputs argumnets based on the server which we deployed?

Like splunk-addon-shellscript

inputs.conf

Server1

[script:abc.sh "argument1"]
disabled=0

[script:abc.sh "argmnet2"]
disabled=1

Server2

[script:abc.sh "argument1"]
disabled=1

[script:abc.sh "argmnet2"]
disabled=0

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...