splunk add oneshot completion status

[egrignon]

Hello,

We are using the splunk add oneshot feature to index some files that we are not indexed all the time. (This is being done from a splunk universal forwarder 4.3.4)

Is there any way to know the completion of indexing after running oneshot on multiple files?

I would like to be notified in some way that all my oneshot files are indexed so that I can start searching.

Thanks,

Etienne

[bmacias84]

I believe this would be something you would have to build into a script at the end of your script you could have it send an SMPT email or out put some text.

You could create saved search looking at the _internal index for oneshot completions or the text output from your script. Then have the search kick of an alert or email. a

Below are some examples which could solve your problem.

Additional info:

http://docs.splunk.com/Documentation/Splunk/4.3.3/Data/MonitorfilesanddirectoriesusingtheCLI

http://docs.splunk.com/Documentation/Splunk/4.3.1/Developer/ScriptedInputsIntro

On your forwarer edit you inputs.conf

#windows
[script://.daily_file.bat c:\somedir\somelog.log]
disabled = true
index = main
source = c:\somedir\somelog.log
sourcetype = ras
interval = 0 0 * * *

#*nix
[script://./bin/daily_file.sh /somedir/somelog.log]
disabled = true
index = main
source = /somedir/somelog.log
sourcetype = ras
interval = 0 0 * * *

Option 1

#*nix

#!/bin/bash

$to=' -to somedue@@somecompany.net'

$f=' -f Blat@@splunk.net'

$msg='"Tim it is @time on @date"'

$server=' -server localhost'

echo "start OneShot"

$SPLUNK_HOME/bin/splunk add oneshot $1 -auth admin:changeme

./blat - $to $f -subject $msg -body $msg $server -q

echo "Oneshot Complete"

done

#windows

set eMail=somedude@somecompany.net

set subj=-s "Test Blat"

set server=-server localhost

set x=-x "X-Header-Test: Can Blat do it? Yes it Can!"

set debug=-debug -log blat.log -timestamp 

echo start OneShot Load

%splunk%\splunk add oneshot %1 -auth admin:changeme

echo completed OneShot Load

blat %0 -to %eMail% -f %eMail% %subj% %server% %debug% %x%

Option 2
This will read the output from cat or type which would normally be displayed on your CMD prompt.

#*nix

#!/bin/bash

$to=' -to somedue@@somecompany.net'

$f=' -f Blat@@splunk.net'

$msg='"Tim it is @time on @date"'

$server=' -server localhost'

echo "start OneShot"

cat $1

./blat - $to $f -subject $msg -body $msg $server -q

echo "Oneshot Complete"

done

#windows

set eMail=somedude@somecompany.net

set subj=-s "Test Blat"

set server=-server localhost

set x=-x "X-Header-Test: Can Blat do it? Yes it Can!"

set debug=-debug -log blat.log -timestamp 

echo start OneShot Load

type %1 

echo completed OneShot Load

blat %0 -to %eMail% -f %eMail% %subj% %server% %debug% %x%

Hope this helps you.