By configuring inputs.conf, Splunk can also accept events from scripts. Scripted input is useful for command-line tools, such as vmstat, iostat, netstat, top, etc.
Note: Currently, scripted inputs do not get bundled in the deployment server. In the future, Splunk will support this behavior. For now, use your preferred configuration automation tool to push your script directory to your server classes.
Caution: Scripted inputs use Splunk's environment variables, so if your script refers to an environment variable on your server, make sure to unset it at the beginning of your script. The only environment variable that's likely to cause problems is the library path (most commonly known as LD_LIBRARY_PATH on linux/solaris/freebsd).
ConfigurationNote: Your script must be in the bin/ directory underneath your scripts/ directory.
[script://$SCRIPT]
interval = X
index = {main, $YOUR_INDEX}
sourcetype = {iostat, vmstat, etc} OPTIONAL
source = {iostat, vmstat, etc} OPTIONAL
disabled = falseSplunk keeps one invocation of a script per instance. Intervals are based on when the script completes. So if you have a script configured to run every ten minutes and the script takes 20 minutes complete the next run will be 30 minutes after the first run.
If you want the script to run continuously, write the script to never exit and set it on a short interval. This helps to ensure that if there is a problem the script gets restarted. Splunk keeps track of scripts it has spawned and will shut them down upon exit.
ExampleThis example shows the use of the UNIX top command as a data input source.
$ mkdir $SPLUNK_HOME/etc/apps/scripts
$ #!/bin/sh top -bn 1 # linux only - different OSes have different paramaters
chmod +x $SPLUNK_HOME/etc/apps/scripts/bin/top.sh
$SPLUNK_HOME/etc/apps/scripts/bin/top.sh
[script:///opt/splunk/etc/apps/scripts/bin/top.sh] interval = 5 # run every 5 seconds sourcetype = top # set sourcetype to top source = script://./bin/top.sh # set source to name of script
Note:
[top] BREAK_ONLY_BEFORE = GobblyGook
DATETIME_CONFIG = CURRENT
Comments
No comments have been submitted.