How to do it...

Follow the steps in this recipe to configure a modular input:

  1. Log in to your Splunk server.
  2. From the Apps menu in the upper left-hand corner of the home screen, click on the gear icon:
  3. The Apps settings page will load. Then, click on the Install App from file button.
  4. Click the Choose File button and select the app file that was previously downloaded from Splunkbase, then click the Upload button:
  5. After the app has been installed, from the menu in the top right-hand corner, click on the Settings menu and then click on the Data inputs link.
  6. Click on the Command section:
  7. In the Mod Input Name field, enter a name for the input of SystemInfo. If you are using Linux, enter /usr/bin/vmstat in the Command Name field. If you are using Windows, enter C:\Windows\System32\systeminfo.exe in the Command Name field:

Use the full path if the command to be executed cannot be found on the system PATH.

  1. In the Command Arguments field, enter any argument that needs to be passed to the command listed in the Command Name field. In the Command Execution Interval field, enter a value in seconds for how often the command should be executed (in this case, we will use 60 seconds). If the output is streamed, then leave this field empty and check the Streaming Output field:
  2. In the Source type section, you have the option to either select a predefined source type or select Manual and enter a value. For this recipe, select Manual as the source type and enter cp01_modular_input as the value for the source type.
  3. Click Next.
  4. If everything was successful, you should see a Modular input has been created successfully message:
  1. Click on the Start searching button. The Search & Reporting app will open with the search already populated based on the settings supplied earlier in the recipe. Splunk is now configured to execute the modular input you provided, every 60 seconds, in accordance with the specified interval. You can search for this data returned by the scripted input using the following search over an All time time range:
sourcetype=cp01_modular_input
上一章目录下一章