Getting Data In

Collect data from windows hosts via a command line command?

Pierceyuk
Path Finder

Hi All,

I have a system that runs a service, the only way to get data out and see the status is to go onto the box and run 'system name stats'

It then outputs data in format:

Variable name: value

Variable name2: value

Or 'Error not running' if its broken.
Is there a way to script this input in Splunk so it runs every 10-15 minutes to collect this information?

System is McAfee MOVE AV offload scanner, the details reset after each reboot/service reboot otherwise the details keep increasing in value if that's important

command is 'mvadm stats'

Sample result:

Total number of cksum req:               21119723
Total number of file transfer req:        4893939
Total number of smart file req:            570794
Cksum cache hit:                         16218566
Total av scan req:                        4893843
Total av scan failure:                          0
Data recv failure:                           7445
Resp send failure:                            235
Total scan threads:                           300
Total heart beat threads:                     757
Total idle threads:                           299
Number of requests in queue:                    0
Number of items in cache:                  934445
Avg request process time:                0.060458 sec
Avg request wait time:                   0.000026 sec
Tags (3)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Pierceyuk,

Yes, this is possible in Splunk.

If you're using a Splunk universal forwarder on this McAfee MOVE AV offload scanner, you can setup a script which will run the command and will be triggered by Splunk UF (universal forwarder) so the Splunk indexer will index the result in the end.

Please read the docs about scripted inputs to learn more on this.

hope this helps to get you started ...

cheers, MuS

0 Karma

Pierceyuk
Path Finder

Hi, Yes I am indeed running a UF on these devices, will take a look thanks for the pointers!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...