Since Splunk 5.0, the ability to extend data input functionality has existed such that custom input types can be created and shared while still allowing minor customizations.
Modular inputs build further upon the scripted input model. Originally, any additional functionality required by the user had to be contained within a script. However, this presented a challenge, as no customization of this script could occur from within Splunk itself. For example, pulling data from a source for two different usernames might have needed two copies of a script or might have meant playing around with command-line arguments within your scripted input configuration.
By leveraging the modular input capabilities, developers are now able to encapsulate their code into a reusable app that exposes parameters in Splunk and allows for configuration through the processes familiar to Splunk administrators.
This recipe will walk you through how to install the Command Modular Input, which allows for periodic execution of commands and subsequent indexing of the command output. You will configure the input to collect the data outputted by the vmstat command in Linux and the systeminfo command in Windows.
To step through this recipe, you will need a running Splunk server with a connection to the Internet. There are no other prerequisites.
Follow the steps in this recipe to configure a modular input:
Log in to your Splunk server.
From the Apps menu in the upper left-hand corner of the home screen, click on Find More Apps.
In the search field, enter
command modular inputand click on the magnifying glass icon.
In the search results, click on the Install free button for Command Modular Input.
Enter your Splunk.com credentials and click on Login. Splunk should return with a message saying that the app was installed successfully.
From the home launcher in the top-rightd corner, click on the Settings menu and then click on the Data inputs link.
On the Data inputs page, click on the Command link under Type.
Then, click on New.
In the Mod Input Name field, enter
SystemInfo.If you are using Linux, enter
/usr/bin/vmstatin the Command Name field.If you are using Windows, enter
C:\Windows\System32\systeminfo.exein the Command Name field.
In the Command Arguments field, enter any argument that needs to be passed to the command listed in the Command Name field. In the Command Execution Interval field, enter a value in seconds for how often the command should be executed (in this case, we will use 60 seconds). If the output is streamed, then leave this field empty and check the Streaming Output field.
In the Source type section, you have the option to select a predefined source type or select Manual and enter a value. For the purposes of this recipe, select Manual as the sourcetype and enter
cp01_modular_inputas the value for the sourcetype.Click on Save to save the input. Splunk is now configured to execute the modular input you provided, every 60 seconds, in accordance with the specified interval. You can search for the data returned by the scripted input using the following search over All time:
sourcetype=cp01_modular_input
Modular inputs are bundled as Splunk apps and, once installed, contain all the necessary configuration and code to display them in the Data inputs section of Splunk. In this recipe, you installed a modular input application that allows for periodic execution of commands. You configured the command to execute every minute and index the results of the command each time, giving the results a source type of cp01_modular_input.
Modular inputs can be written in a number of languages and need to follow only a set of interfaces that expose the configuration options and runtime behaviors. Depending on the design of the input, they will either run persistently or run on an interval and will send data to Splunk as they receive it.
Note
You can find several other modular inputs, including REST API, SNMP, and PowerShell, on the Splunk Apps site (http://apps.splunk.com).
To learn how to create your own modular input, refer to the Modular Inputs section of the Developing Views and Apps for Splunk Web manual located at http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev.