Getting Data In

Backfill Scripted Input Data

raidercom
Communicator

I'm running Splunk 8.2.2 in a docker container.

I'm using a separate app with a scripted input to get data into Splunk via a bash script.

That script works perfectly, except when the source API screws up, or when I delete the index and need to backfill all of the previous data.

The scripted input is setup in inputs.conf as:

[script://$SPLUNK_HOME/etc/apps/app/bin/app.sh]
interval = */5 * * * *

 

Is there a way to manually run a script one time and have splunk consume the output?  I'd really like to avoid setting up a regular monitor, and have splunk consume a regular file just for a backfill operation.  I'd also like to avoid modifying the working scripted input.

 

Thank you for any suggestions you can provide.

Labels (1)
0 Karma
1 Solution

raidercom
Communicator

I ended up merging 2 solutions.

1) scripted input that runs a bash script that outputs to a file

2) monitor that log file

View solution in original post

0 Karma

raidercom
Communicator

I ended up merging 2 solutions.

1) scripted input that runs a bash script that outputs to a file

2) monitor that log file

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!