How to do it...

Follow these steps to configure a scripted input:

  1. Log in to your Splunk server.
  2. From the menu in the top right-hand corner, click on the Settings menu and then click on the Add Data link.
  3. If you are prompted to take a quick tour, click on Skip.
  4. In the How do you want to add data section, click on Monitor.
  5. Click on the Scripts section:
  6. A form will be displayed with a number of input fields. In the Script Path drop-down, select the location of the script. All scripts must be located in a Splunk bin directory, either in $SPLUNK_HOME/bin/scripts or an appropriate bin directory within a Splunk app, such as $SPLUNK_HOME/etc/apps/search/bin.
  7. In the Script Name dropdown, select the name of the script. In the Commands field, add any command-line arguments to the auto-populated script name.
  1. Enter the value in the Interval field (in seconds) in which the script is to be run (the default value is 60.0 seconds) and then click Next:
  2. In the Source Type section, you have the option to either select a predefined source type or to select New and enter your desired value. For the purpose of this recipe, select New as the source type and enter cp01_scripted_input as the value for the source type. Then click Review:
  3. By default, data will be indexed into the Splunk index of main. To change this destination index, select your desired index from the drop-down list in the Index section of the form.

  4. Review the settings. If everything is correct, click Submit.

  5. If everything was successful, you should see a Script input has been created successfully message:

  6. Click on the Start searching button. The Search & Reporting app will open with the search already populated based on the settings supplied earlier in the recipe. Splunk is now configured to execute the scripted input you provided every 60 seconds, in accordance with the specified interval. You can search for the data returned by the scripted input using the following search:
sourcetype=cp01_scripted_input