Getting Data In

Windows Scripted Input specify index

Viorel
Explorer

I am probably overengineering this but this is the only way I could get a script to execute on UF, via a deployed application's bin folder 🙂

I have a .path file which executes powershell.exe -command "& 'path_to_ps1_script'" and it's placed, as stated, in myapp\bin\scripts folder

The PS1 script, returns a valid JSON.

The app's inputs.conf stanza:

[script://$SPLUNK_HOME\etc\apps\<my app>\bin\scripts\myscript.path]
disabled=false
interval=60
sourcetype=my_source_type
source=my_source
send_index_as_argument_for_path=false
index=my_index

As soon as I put index=my_index in my stanza, the data is not being indexed for some reason.

If I remove the index, the data is indexed into the default "main" index, however i'm looking for a solution to send that data to an index I specify

 

Any suggestions ?

 

Labels (1)
0 Karma
1 Solution

Viorel
Explorer

For some reason, deleting the index from the indexer server and then re-creating it, fixed the issue.

Thank you all for your suggestions

View solution in original post

Viorel
Explorer

For some reason, deleting the index from the indexer server and then re-creating it, fixed the issue.

Thank you all for your suggestions

matt8679
Path Finder

Remove these from the inputs.conf

source=my_source
send_index_as_argument_for_path=false

0 Karma

PickleRick
Ultra Champion

Well... it should work so it's strange that it doesn't.

Do you have any related errors in _internal (from either your UF or your downstream idxs/HFs)?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does my_index exist on the indexers and is it the right type?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Viorel
Explorer

yes it does exist and it's of a right type ...

Forgot to mention, i'm using splunk 8.2.1

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...