Splunk Search

How to get the json results of my custom script in Splunk?

rockzers
Path Finder

i created a custom python api script and it works fine and i want to import in splunk

so i put my script. "C:\\Program Files\\Splunk\\etc\\apps\\search\\bin\\sample.py"

I run cmd and the result is getting correctly

in splunk i created data inputs -> scripts -> select my scripts -> select source type _json -> app context App Browser -> selected index

but i am not getting any json results in splunk search index

Is there any configuration needed?

when i check input.config it is already correctly the file details, so why splunk index doesn't show any json data?

[script://$SPLUNK_HOME\etc\apps\search\bin\sample.py]
disabled = false 
host = home 
index = jsearch 
interval = 60.0 
sourcetype = _json   
Labels (1)
Tags (3)
0 Karma

VatsalJagani
Champion

@rockzers - Try updating the stanza name to:

[script://$SPLUNK_HOME/etc/apps/search/bin/sample.py]

 

I hope this helps!!!

0 Karma

rockzers
Path Finder

@VatsalJagani 

i used windows so that stanza is there 

0 Karma

VatsalJagani
Champion

@rockzers - Okay.

Do you see the input when you open Splunk Web UI and Go to "Settings > Inputs"?

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...