Getting Data In

Scripted Input - Windows Indexer - Linux Host

runwithscizzors
New Member

Looking for the best way to collect Disk Free Space from a Linux box to a Windows Indexer. Company policy wont let me put a light weight forwarder on the host.

Would like to collect the output from a "df -h" and run this every x period of time and have the input collected into Splunk.

I know I need to run some Scripted Input from the host, but how will this work from a Windows Indexer?

Indexer - Windows 2003 Server Linux - Red Hat

Tags (1)
0 Karma

Dan
Splunk Employee
Splunk Employee

Just curious what issue the company has with the light weight forwarder? Are there any changes Splunk can make to the LWF to make it compliant?

Anyway, here are a few ideas:

  • .bat scripted input that uses ssh to login to Linux and execute the df -h command. You'd have to install a CLI friendly ssh client on the Windows box. I'd also recommend distributing keys rather than hard-coding credentials in the script.
  • same kind of scripted input as above, but using snmp polling. Much more light-weight. Look at something like Cacti.
  • you can samba mount the disk and use Windows' native methods such as perf counters. Probably the fastest but least production-ready solution.
  • Would company policy allow you to put your own cron script on the Linux box that runs df -h | netcat?

Lowell
Super Champion

Additional suggestion based Dan's 1st suggestion. Rather than using df -h, you could use the df.sh script that's bundled in the unix app's bin folder (if you allowed to place that on the linux machine). I think you could use the plink tool in that comes with Putty (ssh client for windows). You could also use the Putty Agent to store ssh keys for the whole auth thing.

Get Updates on the Splunk Community!

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...