Splunk Search

Pass arguments for shell script in inputs.conf?

ansif
Motivator

How to pass arguments to a script from inputs.conf?

example:
shell_script.sh server1 server2

Tags (1)
0 Karma

PavelP
Motivator

Hello @ansif

you cannot use parameters in the script stanza. Insted you should use .path format, which is more flexible:

[script://<cmd>]
* Runs <cmd> at a configured interval (see below) and indexes the output
  that <cmd> returns.
* The <cmd> must reside in one of the following directories:
  * $SPLUNK_HOME/etc/system/bin/
  * $SPLUNK_HOME/etc/apps/$YOUR_APP/bin/
  * $SPLUNK_HOME/bin/scripts/
* The path to <cmd> can be an absolute path, make use of an environment
  variable such as $SPLUNK_HOME, or use the special pattern of an initial '.'
  as the first directory to indicate a location inside the current app.
* The '.' specification must be followed by a platform-specific directory
  separator.
  * For example, on UNIX:
        [script://./bin/my_script.sh]
    Or on Windows:
        [script://.\bin\my_program.exe]
    This '.' pattern is strongly recommended for app developers, and necessary
    for operation in search head pooling environments.
* <cmd> can also be a path to a file that ends with a ".path" suffix. A file
  with this suffix is a special type of pointer file that points to a command
  to be run. Although the pointer file is bound by the same location
  restrictions mentioned above, the command referenced inside it can reside
  anywhere on the file system. The .path file must contain exactly one line:
  the path to the command to run, optionally followed by command-line
  arguments. The file can contain additional empty lines and lines that begin
  with ''. The input ignores these lines.
0 Karma

to4kawa
Ultra Champion

You can write as it is

0 Karma

ansif
Motivator

Thanks @to4kawa to confirm.

One additional question, can we keep one single addon and enable inputs argumnets based on the server which we deployed?

Like splunk-addon-shellscript

inputs.conf

Server1

[script:abc.sh "argument1"]
disabled=0

[script:abc.sh "argmnet2"]
disabled=1

Server2

[script:abc.sh "argument1"]
disabled=1

[script:abc.sh "argmnet2"]
disabled=0

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...