Getting Data In

Scripted input question for batch file

sieutruc
Contributor

Hello,
I cannot get the value of scripted input by using batch file as wrapper script. My configuration is as below:
MemoryPerf.bat and counters.exe in etc\system\bin

@ECHO OFF 

counters.exe 6 Memory "Page Faults/sec" "%% Committed Bytes In Use" "Committed Bytes" "Pages/sec" "Available MBytes"

Inputs.conf in etc\system\local

[script://$SPLUNK_HOME\etc\system\bin\MemoryPerf.bat]
interval = 6
index = default
source = cript://MemoryPerf.bat
disabled = 0

But after that, it didn't work. i opened task manager and did't see the counters instance in the list too. Do you know what wrong i did ?

Tags (1)
0 Karma
1 Solution

adamw
Communicator

Your source= might be causing an issue. By default, Splunk will set up the source value to $SPLUNK_HOME\etc\system\bin\MemoryPerf.bat, I would comment out this line and see if it starts working.

Also, take a look at $SPLUNK_HOME\var\log\splunk\splunkd.log, and it should tell you if the script is actually executing or not. You can also run $SPLUNK_HOME\bin\splunk cmd btool inputs list to see if you can find your script listed, as this will indicate if the configuration is correct.

View solution in original post

sieutruc
Contributor

I have already found the solution. Intuitively, i guess that Splunk, when it runs, it will set the current directory for batch file as C:\Windows\system32 to get cmd.exe. So in order to change back to the current place where the batch file is being stored, we use a small trick and put it at the beginning of the batch script as

@ECHO OFF

cd /d %~dp0

[your script at the same folder as batch file]

Thanks for your suggestion about splunkd.log.

adamw
Communicator

Your source= might be causing an issue. By default, Splunk will set up the source value to $SPLUNK_HOME\etc\system\bin\MemoryPerf.bat, I would comment out this line and see if it starts working.

Also, take a look at $SPLUNK_HOME\var\log\splunk\splunkd.log, and it should tell you if the script is actually executing or not. You can also run $SPLUNK_HOME\bin\splunk cmd btool inputs list to see if you can find your script listed, as this will indicate if the configuration is correct.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...