Getting Data In

Where on a Windows machine should I store logs generated from custom scripts for Splunk Universal Forwarder to forward?

landen99
Motivator

Running a log-generating script locally on a Windows machine with a Splunk UF, I am looking for best practices for where to store the script log files. I imagine that there may be permissions issues with trying to store them under a user account or in the Windows directory. Splunk will run the custom script either periodically or constantly.

0 Karma
1 Solution

Jeremiah
Motivator

If you are using Splunk to run the script, you should store the scripts in a Splunk app:

http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ScriptedInputsIntro

Place scripts in the bin directory of your app:

$SPLUNK_HOME/etc/apps/<appname>/bin/

If you have Splunk run the scripts as inputs, you don't need to generate log files. Splunk will read the script output and forward it to your indexers.

View solution in original post

0 Karma

Jeremiah
Motivator

If you are using Splunk to run the script, you should store the scripts in a Splunk app:

http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ScriptedInputsIntro

Place scripts in the bin directory of your app:

$SPLUNK_HOME/etc/apps/<appname>/bin/

If you have Splunk run the scripts as inputs, you don't need to generate log files. Splunk will read the script output and forward it to your indexers.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...