topic Re: shell script is generating only 2 lines of output in splunk in Getting Data In

shell script is generating only 2 lines of output in splunk

raj_mpl — Tue, 18 Dec 2018 04:46:31 GMT

Hello All,
I can see only 2 lines of output in every event in search head , Here the input is shell script

Any Suggestions ?

Re: shell script is generating only 2 lines of output in splunk

harsmarvania57 — Tue, 18 Dec 2018 08:54:26 GMT

Hi,

Can you please provide more info ? What shell script are you running ? Where are you running shell script ? And what problem are you facing while executing Shell Script in Splunk?

Re: shell script is generating only 2 lines of output in splunk

raj_mpl — Tue, 29 Sep 2020 22:25:23 GMT

Hi @harsmarvania57

Thanks for your response , I had followed the documentation and placed my Linux environment shell script in app/myapp/bin folder and provided inputs.conf in app/myapp/local folder
under the [script] stanza , the attributes given like below

interval = 300
sourcetype = my_st
source = my_st
index = main
disabled = 0

The script is working fine in server( giving the required output of 9 lines) . But in search head we are getting only 2 lines of each event

Re: shell script is generating only 2 lines of output in splunk

harsmarvania57 — Tue, 18 Dec 2018 11:04:47 GMT

There might be possibility that Splunk is not parsing events properly and indexing data with wrong timestamp, can you please try to search data for particular sourcetype with All Time timeframe ?

Re: shell script is generating only 2 lines of output in splunk

raj_mpl — Tue, 18 Dec 2018 11:14:53 GMT

I am seeing the partial data o/p from the time when I configured and restarted my Universal Forwarder . But when I searched with ALL Time , I can see some events with complete output but those are 2016 time stamped

Re: shell script is generating only 2 lines of output in splunk

harsmarvania57 — Tue, 18 Dec 2018 11:55:59 GMT

Here you go which means Splunk is not parsing timestamp correctly. Best practice is while generating scripted output, every event should start with timestamp so that splunk will parse those events with correct date time.

Additionally if require you can define TIME_PREFIX, TIME_FORMAT and MAX_TIMESTAMP_LOOKAHEAD on Indexer/Heavy Forwarder for sourcetype my_st