Getting Data In

Checkpointing scripts for subsequent invocations

dveith
Explorer

I'm writing an Add-on script for the universal forwarder that will read several log files containing complex data and reformat the data so that Splunk can more easily parse it.

Does my script need to implement it's own logic for "where it left off last time it was invoked" or does Splunk help with that somehow?

In other words, is it possible to have 'monitor' functionality, but with my own custom script?

Thanks.

Tags (1)
0 Karma

dwaddle
SplunkTrust
SplunkTrust

If you script is being run as a scripted input, then you will need to maintain last-run state for yourself. Some of Splunk's own scripted inputs (like in the *nix app) do this as well - by keeping a file with an epoch time stored in it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...