Splunk创建脚本输入

1、cd /opt/splunk/etc/system/bin

cd /opt/splunk/bin/scripts/(默认目录)

vi 4444.sh

#!/bin/sh

/usr/bin/vmstat

chmod +x ./4444.sh

2. vi /opt/splunk/etc/system/local/inputs.conf

增加如下内容：

[script:///opt/splunk/etc/system/bin/4444.sh]

sourcetype= 333

interval= 30

3.重启Splunk服务，等30秒，搜索sourcetype=333