Getting Data In

What are the advantages and disadvantages of using scripted input vs file input ?

dheeran
Engager

I am having a scenario where a script can either produce a csv or a stdout.
Which is the best route to ingest this data?

The dataset in question is employee information where we do not expect a huge number of new records every day.

Thanks in advance
Siva

0 Karma
1 Solution

ivanreis
Builder

I would suggest to produce the csv instead of stdout. If you lose any network connectivity the data you are trying to run thought stdout can be lost, if you do not have any buffer to store this data.
According to the Splunk Administration manual, this is the only the downside of using scripting inputs.
"One possible downside to scripted input is potential loss of data
– Example: the forwarder that is running the script is not able to connect to the indexer due to networking problems".

View solution in original post

ivanreis
Builder

I would suggest to produce the csv instead of stdout. If you lose any network connectivity the data you are trying to run thought stdout can be lost, if you do not have any buffer to store this data.
According to the Splunk Administration manual, this is the only the downside of using scripting inputs.
"One possible downside to scripted input is potential loss of data
– Example: the forwarder that is running the script is not able to connect to the indexer due to networking problems".

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...