![]() The following snippet from a script contains an example XML scheme. You only need to write your own introspection scheme to specify behavior that differs from the default behavior. Note: When getting started writing scripts, consider using the default introspection scheme. Splunk software uses the default introspection scheme in this scenario. If you do not provide an introspection scheme, exits with return code 0.If you implement an introspection scheme, writes the scheme to stdout.Your script must provide a "-scheme" argument, which when specified, does the following: If you do not provide an element, then Splunk software uses the default value for that element, which may or may not be appropriate for your script. If you do provide an introspection scheme, each element in the scheme is optional. If you do not provide the introspection scheme, the Settings page displays default values, which may or may not be appropriate for your script. Providing an introspection scheme with your script is optional. Use a single script or multiple script instances.The title and description for the script, which is used in the Settings pages for creating or editing instances of the script.The endpoint definition for your script, which includes required and optional parameters to create and modify the endpoint.You define both the behavior and endpoints for a script in an XML scheme that the script returns to splunkd.ĭuring introspection, splunkd reads the scheme to implement your script as a modular input. See Tips for writing scripts for modular and scripted inputs in Splunk Cloud Platform or Splunk Enterprise on the Splunk developer portal for tips and best practices for writing scripts. Twitter example Amazon S3 example General tips on writing scripts See Modular Inputs examples for listings and descriptions of Modular Inputs example scripts. The following type of executable files are recognized for introspection:įilename (executable file without an extension) Executable files recognized for introspection Only use a platform-specific directory if required for that architecture. Note: Always have a platform-neutral version of the script in the default bin directory. Otherwise, a platform-neutral version of the script runs in the default bin directory. If you place a script in an architecture-specific directory, the script runs the appropriate version of the script if installed on that platform. The following bin directories, relative to $SPLUNK_HOME/etc, are available for the corresponding Intel architectures: The architecture-specific directories are all Intel-based. Architecture-specific version directories are only available for the following subset of architectures that Splunk Enterprise supports. However, you can provide an architecture-specific version of a modular input script by placing the appropriate version of the script in the corresponding architecture-specific bin directory in your Splunk Enterprise installation. Typically, you use the default bin directory for scripts: Stream data as text or as XML, using checkpoints (scenario 3) If validation fails, exit writing error code to stdout Implement -validate-arguments arg to validate configuration (scenario 2) Implement routines to validate configuration Implement -scheme arg to print the scheme to stdout (scenario 1) This also assumes that you are checkpointing data to avoid reading from the same source twice, as described in Data checkpoints. This example assumes that there is a valid spec file, as described in Modular inputs spec file. The following pseudo-code describes the behavior of a modular input script. ![]() The data can be streamed as plain text or as XML, as described in Set up streaming. The script streams event data that can be indexed. The script has routines to validate its configuration, as described in Set up external validation. Splunkd runs the script to determine the behavior and configuration. The introspection scheme defines the behavior and endpoints of the script, as described in Define a scheme for introspection.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |