Splunk Search

using a batch file or executable as a source of search information

Keith_Holme
Engager

I would like to execute an .exe or .bat file on a windows box and use the stdout as the results in a search. How can this be achieved.

Tags (2)
0 Karma

gallantalex
Path Finder

In your $SPLUNK_HOME\bin\scripts folder you could add another .path file. The .path file which will have one line which is the absolute path to your .exe or .bat file that you want to execute.

Now in Splunk web, go to manager -> data inputs -> scripts and add a new script. Set the command field as the file location of the .path file you created. Fill in all other fields accordingly.

You may have to restart Splunk in order for your changes to occur, I am not certain if that is the case though. I added my scripts by changing the input.conf file instead of using SplunkWeb, and I did have to restart.

Also, you could move your .bat file into $SPLUNK_HOME\bin\scripts folder and access it directly. Not sure if the same goes for an .exe file.

Keith_Holme
Engager

Thanks for the answer to my question.

From my understanding, if I add the script to the search/bin dir in order to perform a search against it I nned to add a stanza to the inputs.conf file. This all seems to work, however, I have to add an interval entry to the stanza (or the system updates the data every 60 seconds). This is not really what I want to do. I wuld really like to get the data strainght from the script and update some controls from that script. I don't want splunk to aggregate the data. Any ideas would be great.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...