Getting Data In

How do I run a shell script in a universal forwarder?

raj_mpl
Path Finder

I have a problem here. My shell script is not giving the complete output in the Splunk search head . What is the command to check and run the script in the UF?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@raj_mpl ,

If you are referring to the scripted inputs , then most likely it should be part of an app. To find the location of the script, use btool and list all the inputs

SPLUNK_HOME/bin/splunk btool inputs list --debug|grep "your script name"

Once you find the script, you may execute them on your forwarder to verify the result by either using the absolute path or relative path.

For e.g. if your script is located in SPLUNK_HOME/etc/apps/my_app/bin/myscript.sh , you may run it using the entire path or

cd SPLUNK_HOME/etc/apps/my_app/bin/
./myscript.sh

where SPLUNK_HOME is your splunk installation directory

Reference:

Scripted Input:

[script://<cmd>]
* Runs <cmd> at a configured interval (see below) and indexes the output
  that <cmd> returns.
* The <cmd> must reside in one of the following directories:
  * $SPLUNK_HOME/etc/system/bin/
  * $SPLUNK_HOME/etc/apps/$YOUR_APP/bin/
  * $SPLUNK_HOME/bin/scripts/
* The path to <cmd> can be an absolute path, make use of an environment
  variable such as $SPLUNK_HOME, or use the special pattern of an initial '.'
  as the first directory to indicate a location inside the current app.
* The '.' specification must be followed by a platform-specific directory
  separator.
  * For example, on UNIX:
        [script://./bin/my_script.sh]
    Or on Windows:
        [script://.\bin\my_program.exe]
    This '.' pattern is strongly recommended for app developers, and necessary
    for operation in search head pooling environments.
* <cmd> can also be a path to a file that ends with a ".path" suffix. A file
  with this suffix is a special type of pointer file that points to a command
  to be run. Although the pointer file is bound by the same location
  restrictions mentioned above, the command referenced inside it can reside
  anywhere on the file system. The .path file must contain exactly one line:
  the path to the command to run, optionally followed by command-line
  arguments. The file can contain additional empty lines and lines that begin
  with '#'. The input ignores these lines.
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@raj_mpl ,

If you are referring to the scripted inputs , then most likely it should be part of an app. To find the location of the script, use btool and list all the inputs

SPLUNK_HOME/bin/splunk btool inputs list --debug|grep "your script name"

Once you find the script, you may execute them on your forwarder to verify the result by either using the absolute path or relative path.

For e.g. if your script is located in SPLUNK_HOME/etc/apps/my_app/bin/myscript.sh , you may run it using the entire path or

cd SPLUNK_HOME/etc/apps/my_app/bin/
./myscript.sh

where SPLUNK_HOME is your splunk installation directory

Reference:

Scripted Input:

[script://<cmd>]
* Runs <cmd> at a configured interval (see below) and indexes the output
  that <cmd> returns.
* The <cmd> must reside in one of the following directories:
  * $SPLUNK_HOME/etc/system/bin/
  * $SPLUNK_HOME/etc/apps/$YOUR_APP/bin/
  * $SPLUNK_HOME/bin/scripts/
* The path to <cmd> can be an absolute path, make use of an environment
  variable such as $SPLUNK_HOME, or use the special pattern of an initial '.'
  as the first directory to indicate a location inside the current app.
* The '.' specification must be followed by a platform-specific directory
  separator.
  * For example, on UNIX:
        [script://./bin/my_script.sh]
    Or on Windows:
        [script://.\bin\my_program.exe]
    This '.' pattern is strongly recommended for app developers, and necessary
    for operation in search head pooling environments.
* <cmd> can also be a path to a file that ends with a ".path" suffix. A file
  with this suffix is a special type of pointer file that points to a command
  to be run. Although the pointer file is bound by the same location
  restrictions mentioned above, the command referenced inside it can reside
  anywhere on the file system. The .path file must contain exactly one line:
  the path to the command to run, optionally followed by command-line
  arguments. The file can contain additional empty lines and lines that begin
  with '#'. The input ignores these lines.
Happy Splunking!
0 Karma

raj_mpl
Path Finder

Thank you @renjith.nair

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...