using a batch file or executable as a source of search information

[Keith_Holme]

I would like to execute an .exe or .bat file on a windows box and use the stdout as the results in a search. How can this be achieved.

[gallantalex]

In your $SPLUNK_HOME\bin\scripts folder you could add another .path file. The .path file which will have one line which is the absolute path to your .exe or .bat file that you want to execute.

Now in Splunk web, go to manager -> data inputs -> scripts and add a new script. Set the command field as the file location of the .path file you created. Fill in all other fields accordingly.

You may have to restart Splunk in order for your changes to occur, I am not certain if that is the case though. I added my scripts by changing the input.conf file instead of using SplunkWeb, and I did have to restart.

Also, you could move your .bat file into $SPLUNK_HOME\bin\scripts folder and access it directly. Not sure if the same goes for an .exe file.

[Keith_Holme]

Thanks for the answer to my question.

From my understanding, if I add the script to the search/bin dir in order to perform a search against it I nned to add a stanza to the inputs.conf file. This all seems to work, however, I have to add an interval entry to the stanza (or the system updates the data every 60 seconds). This is not really what I want to do. I wuld really like to get the data strainght from the script and update some controls from that script. I don't want splunk to aggregate the data. Any ideas would be great.