Getting Data In

Backfill Scripted Input Data

raidercom
Communicator

I'm running Splunk 8.2.2 in a docker container.

I'm using a separate app with a scripted input to get data into Splunk via a bash script.

That script works perfectly, except when the source API screws up, or when I delete the index and need to backfill all of the previous data.

The scripted input is setup in inputs.conf as:

[script://$SPLUNK_HOME/etc/apps/app/bin/app.sh]
interval = */5 * * * *

 

Is there a way to manually run a script one time and have splunk consume the output?  I'd really like to avoid setting up a regular monitor, and have splunk consume a regular file just for a backfill operation.  I'd also like to avoid modifying the working scripted input.

 

Thank you for any suggestions you can provide.

Labels (1)
0 Karma
1 Solution

raidercom
Communicator

I ended up merging 2 solutions.

1) scripted input that runs a bash script that outputs to a file

2) monitor that log file

View solution in original post

0 Karma

raidercom
Communicator

I ended up merging 2 solutions.

1) scripted input that runs a bash script that outputs to a file

2) monitor that log file

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...