Consider the following stanza in inputs.conf: What will the value of the source filed be for events generated by this scripts input?

The correct answer is A. /opt/splunk/ecc/apps/search/bin/liscer.sh. For scripted inputs defined in inputs.conf, Splunk sets the 'source' field to the full file path of the script being executed by default, unless a 'source' override is explicitly defined in the stanza. Since no override is specified in the given stanza, the source field will be…

Configuration Files

Question

Consider the following stanza in inputs.conf:

What will the value of the source filed be for events generated by this scripts input?

Options

A/opt/splunk/ecc/apps/search/bin/liscer.sh
Bunknown
Cliscer
Dliscer.sh

How the community answered

(38 responses)

A
89% (34)
B
3% (1)
C
5% (2)
D
3% (1)

Explanation

For scripted inputs defined in inputs.conf, Splunk sets the 'source' field to the full file path of the script being executed by default, unless a 'source' override is explicitly defined in the stanza. Since no override is specified in the given stanza, the source field will be the full path of the script, which is /opt/splunk/ecc/apps/search/bin/liscer.sh. Splunk does not use just the filename (D) or script name without extension (C) as the default source for scripted inputs. 'unknown' (B) would only appear if the source truly could not be determined.

Topics

#inputs.conf#source field#script input#event metadata

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice