topic Re: Why is scripted input only giving the first line? in Getting Data In

Why is scripted input only giving the first line?

ericrobinson — Wed, 03 Nov 2010 09:20:09 GMT

I have tried following http://www.splunk.com/base/Documentation/latest/Admin/Setupcustom(scripted)inputs, but I am having no luck. I cant seem to get the BREAK_ONLY_BEFORE to work for me..

My script is basically a wrapper around pkginfo.

It returns package information with each package on a new line.

Please help! Anyone!

Here is the inputs and props.conf located in $SPLUNK_HOME/etc/apps/scripts/default

inputs.conf:
[script://$SPLUNK_HOME/etc/apps/scripts/bin/pi.sh]
interval = 60
sourcetype = pkginfo
source = pkginfo
disabled = 0


props.conf:
[pkginfo]
SHOULD_LINEMERGE = false
LINE_BREAKER = (?!)

Re: Why is scripted input only giving the first line?

gkanapathy — Wed, 03 Nov 2010 14:40:06 GMT

Just set:

SHOULD_LINEMERGE = false
LINE_BREAKER = (?!)

Assuming that your script is called periodically by a cron schedule.

Re: Why is scripted input only giving the first line?

ericrobinson — Mon, 28 Sep 2020 09:20:20 GMT

This is still not working for me unfortunately..

Here is my props.conf

[pkginfo]
SHOULD_LINEMERGE = false
LINE_BREAKER = (?!)

Here is the inputs.conf:

[script://$SPLUNK_HOME/etc/apps/scripts/bin/pi.sh]
interval = 60
sourcetype = pkginfo
source = pkginfo
disabled = 0

These are both in:
$SPLUNK_HOME/etc/apps/scripts/default

Re: Why is scripted input only giving the first line?

bfaber — Thu, 04 Nov 2010 22:39:36 GMT

Can you share the pi.sh that you are calling?