Splunk Dev

How to configure Splunk to to run my python script every time Splunk starts or restarts?

SIddharth5794
Explorer

I want to run a python script along with Splunk. It should start when Splunk starts and should restart when Splunk restarts. Is there a way of configuring this so that my python script can run every time Splunk starts?

lcrielaa
Communicator

If you're running Splunk on UNIX/Linux, you could edit the startup scripts in /etc/init.d/ to include your script in the start/restart section. Just be careful that if you ever do a "splunk enable boot-start", your changes will get overwritten.

You can also create a scripted input and set the interval to -1 as per the documentation : http://docs.splunk.com/Documentation/Splunk/6.2.5/Data/Setupcustominputs

For one-shot data streams, enter -1. Setting interval to -1 will cause the script to run each time the splunk daemon restarts.

SIddharth5794
Explorer

I found this in init.d file

"The init scripts that used to reside in this directory are deprecated. Splunk
now includes the ability to update the system boot configuration on its own."

0 Karma

lcrielaa
Communicator

not /opt/splunk/etc/init.d/ but /etc/init.d/ of the actual server.

0 Karma

SIddharth5794
Explorer

I don't want to run the script while splunk is not running. I just want to run it when splunk runs. So the running of the script has to be initiated according to the running of splunk.

0 Karma

lcrielaa
Communicator

Which exactly what I'm saying.

Either use the Splunk start/restart script in /etc/init.d/ and hook in your python script there. This will run your script when you start/restart Splunk.

Or

Create a scripted input in Splunk and give it an interval of -1 so that it starts every time you start/restart Splunk. I recommend this option. See the documentation link I provided earlier.

0 Karma

SIddharth5794
Explorer

Ohh.. Thanks! I will try it out.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...