Getting Data In

pass hostname to scripted input

jgeyer14
Engager

Hi, I want to create a scripted input, a script that will query sql server on a machine. I want the query to be executed on whatever host I set up the input for, so I assume I should pass the hostname as an argument to the script. How can I do that dynamically? is there a variable in splunk that can expand automatically? So I could set splunk up to run the script something like this:

script.cmd $hostname

Tags (1)

jgeyer14
Engager

nevermind i figured it out. right now I am adding a new scripted input for each host and passing it manually like so:

first arg is the hostname the script will use to do the query

[script://$SPLUNK_HOME\bin\scripts\test.cmd testhost]
interval = 5
sourcetype = sql:test        
source = jamiesqltest
host=testhost
disabled=0


[script://$SPLUNK_HOME\bin\scripts\test.cmd testhost-2]
interval = 5
sourcetype = sql:test        
source = jamiesqltest
host=testhost-2
disabled=0
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...