Getting Data In

scripted input execute condition

aaronkorn
Splunk Employee
Splunk Employee

Hello,

We are working towards a scripted input of AIX errpt messages and would like to kick the script off whenever it notices the timestamp changes, ie. when a new event is added. The file is binary so we need to have a custom script to run first to decode the data then dump it to a file. Any idea on how to do a conditional script interval in inputs.conf? Also, if you have seen a better way to aggregate errpt messages please feel free to share. Thanks!

0 Karma

sowings
Splunk Employee
Splunk Employee

I don't have an answer, per se, but I have some input:

There's a magic value to interval in an inputs.conf script: specifier (I think it's zero) that means "run once on startup". But then you'd have to restart the forwarder a lot.

If I were asked to implement this, I would put the logic in my script. I'd use a persistent state file (maybe in $SPLUNK_HOME/var/lib/splunk/persistentstorage) to keep track of the last stamp we'd seen, then use this script to inspect the file on each run. Most executions of the script are going to be no-ops "data hasn't changed!", but when it does execute the decoding loop, you'll want to make sure that the interval of the script is longer than the amount of time a single run would take. Splunk shouldn't start a second instance until the first is done, but I would schedule my runs so that I didn't have to rely upon that.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...