-
Book Overview & Buying
-
Table Of Contents
Splunk Operational Intelligence Cookbook - Second Edition
By :
Since Splunk 5.0, the ability to extend data input functionality has existed such that custom input types can be created and shared while still allowing for user customization to meet needs.
Modular inputs build further upon the scripted input model. Originally, any additional functionality required by the user had to be contained within a script. However, this presented a challenge, as no customization of this script could occur from within Splunk itself. For example, pulling data from a source for two different usernames needed two copies of a script or meant playing around with command-line arguments within your scripted input configuration.
By leveraging the modular input capabilities, the developers are now able to encapsulate their code into a reusable app that exposes parameters in Splunk and allows for configuration through processes familiar to Splunk administrators.
This recipe will walk you through how to install the Command Modular Input, which allows for periodic execution of commands and subsequent indexing of the command output. You will configure the input to collect the data output by the vmstat command in Linux and the systeminfo command in Windows.
To step through this recipe, you will need a running Splunk server with a connection to the Internet. No other prerequisites are required.
Follow the steps in this recipe to configure a modular input:

command modular input and press Enter.





SystemInfo. If you are using Linux, enter /usr/bin/vmstat in the Command Name field. If you are using Windows, enter C:\Windows\System32\systeminfo.exe in the Command Name field.
Use the full path if the command to be executed cannot be found on the system PATH.

cp01_modular_input as the value for the source type.
sourcetype=cp01_modular_input
Modular inputs are bundled as Splunk apps and, once installed, contain all the necessary configuration and code to display them in the Data inputs section of Splunk. In this recipe, you installed a modular input application that allows for periodic execution of commands. You configured the command to execute every minute and index the results of the command each time, giving the results a source type of cp01_modular_input.
Modular inputs can be written in a number of languages and need to follow only a set of interfaces that expose the configuration options and runtime behaviors. Depending on the design of the input, they will either run persistently or run on an interval and will send data to Splunk as they receive it.
You can find several other modular inputs, including REST API, SNMP, and PowerShell, on the Splunk Apps site (http://splunkbase.splunk.com).
To learn how to create your own modular input, refer to the Modular Inputs section of the Developing Views and Apps for Splunk Web manual located at http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModInputsIntro.
Also refer to the following recipes for more information:
Change the font size
Change margin width
Change background colour