https://community.splunk.com/t5/Splunk-Enterprise/Not-getting-events-from-sourcetype-Unix-Uptime-from-Splunk-Add/m-p/580635#M11112 <P>You should try to run this script as user which are running UF client. Also try it with splunk cmd …../path/to/script. Then if/when needed fix reported errors.</P> Tue, 11 Jan 2022 15:56:11 GMT isoutamo 2022-01-11T15:56:11Z https://community.splunk.com/t5/Splunk-Enterprise/Not-getting-events-from-sourcetype-Unix-Uptime-from-Splunk-Add/m-p/580630#M11109 <P>Hello,</P><P>I am not getting events from the uptime.sh which gives system date and uptime information via the shell command. This script is a part of Splunk Add-On for Unix and Linux which is installed on the universal forwarder. I am getting data from other inputs like cpu.sh, vmstat.sh, df.sh etc...but not only from uptime.sh. I check the disabled is also set to false and in sync with other stanzas like the stanzas of cpu,vmstat etc. Any insights into if I am missing anything?</P><P>&nbsp;</P> Tue, 11 Jan 2022 15:48:03 GMT https://community.splunk.com/t5/Splunk-Enterprise/Not-getting-events-from-sourcetype-Unix-Uptime-from-Splunk-Add/m-p/580630#M11109 mayankrojo 2022-01-11T15:48:03Z https://community.splunk.com/t5/Splunk-Enterprise/Not-getting-events-from-sourcetype-Unix-Uptime-from-Splunk-Add/m-p/580631#M11110 <P>Check the bin folder see if there any scripts which have different permissions than those of working ones.</P> Tue, 11 Jan 2022 15:51:52 GMT https://community.splunk.com/t5/Splunk-Enterprise/Not-getting-events-from-sourcetype-Unix-Uptime-from-Splunk-Add/m-p/580631#M11110 SinghK 2022-01-11T15:51:52Z https://community.splunk.com/t5/Splunk-Enterprise/Not-getting-events-from-sourcetype-Unix-Uptime-from-Splunk-Add/m-p/580634#M11111 <P>I checked with the permissions of the script in the default folder. It is exactly the same like others.</P> Tue, 11 Jan 2022 15:54:19 GMT https://community.splunk.com/t5/Splunk-Enterprise/Not-getting-events-from-sourcetype-Unix-Uptime-from-Splunk-Add/m-p/580634#M11111 mayankrojo 2022-01-11T15:54:19Z https://community.splunk.com/t5/Splunk-Enterprise/Not-getting-events-from-sourcetype-Unix-Uptime-from-Splunk-Add/m-p/580635#M11112 <P>You should try to run this script as user which are running UF client. Also try it with splunk cmd …../path/to/script. Then if/when needed fix reported errors.</P> Tue, 11 Jan 2022 15:56:11 GMT https://community.splunk.com/t5/Splunk-Enterprise/Not-getting-events-from-sourcetype-Unix-Uptime-from-Splunk-Add/m-p/580635#M11112 isoutamo 2022-01-11T15:56:11Z https://community.splunk.com/t5/Splunk-Enterprise/Not-getting-events-from-sourcetype-Unix-Uptime-from-Splunk-Add/m-p/580641#M11113 <P>I am getting the data when i run the uptime.sh script from command line. But I am not getting the data in Splunk.</P> Tue, 11 Jan 2022 16:20:03 GMT https://community.splunk.com/t5/Splunk-Enterprise/Not-getting-events-from-sourcetype-Unix-Uptime-from-Splunk-Add/m-p/580641#M11113 mayankrojo 2022-01-11T16:20:03Z https://community.splunk.com/t5/Splunk-Enterprise/Not-getting-events-from-sourcetype-Unix-Uptime-from-Splunk-Add/m-p/580748#M11128 <P>If you are run it with "splunk" user and with command&nbsp;</P><LI-CODE lang="markup">/opt/splunkforward/splunk/bin/splunk cmd /path/to/script/uptime.sh</LI-CODE><P>And get answer then it should works.</P><P>Have you gotten anything into _internal logs on that client? Check also local log files under ..../splunk/var/log/splunk</P><P>r. Ismo&nbsp;</P> Wed, 12 Jan 2022 09:51:07 GMT https://community.splunk.com/t5/Splunk-Enterprise/Not-getting-events-from-sourcetype-Unix-Uptime-from-Splunk-Add/m-p/580748#M11128 isoutamo 2022-01-12T09:51:07Z