Implementing Splunk 7 - Third Edition

Making a long-running scripted input

Sometimes, a process needs to be long-running, for instance, if it is polling an external source, such as a database. A simple example might be as follows:

import time 
import random 
import sys 
for i in range(1, 1000): 
print "%s Hello." % time.strftime('%Y-%m-%dT%H:%M:%S') 
#make sure python actually sends the output 
sys.stdout.flush() 
time.sleep(random.randint(1, 5)) 

This script will run for somewhere between 1,000 and 5,000 seconds and then exit.

Since this is a long-running script, our choices are either to treat each line as an event as we did in the Capturing script output with no date section, or, if we know that there is a date to use, configure the input like a regular log file. In this case, we ...