topic Re: Bash echo command no ingested by splunk, whle others are. in Getting Data In

Bash echo command no ingested by splunk, whle others are.

Dpeedahnb — Thu, 26 Nov 2020 12:00:22 GMT

I have these as the final lines of my bash script:

response=$(curl -H "Authorization: Bearer $access_token" -H "Accept: application/json;odata=verbose" -s "$url")
echo "$response"

echo "Test1"

The script runs, however only 'Test 1' is sent to the index/splunk.
My response, which I know returns the response of the curl command, seems to be being ignored. The only reason I can think for this is that it's too large a body?
The response is in json but is quite large, I'd say pages worth.

Re: Bash echo command no ingested by splunk, whle others are.

richgalloway — Thu, 26 Nov 2020 15:51:49 GMT

Anything helpful in splunkd.log?

Re: Bash echo command no ingested by splunk, whle others are.

isoutamo — Thu, 26 Nov 2020 15:55:11 GMT

To se if you get anything what you are expecting just add “ | wc “ inside response evaluation.

Re: Bash echo command no ingested by splunk, whle others are.

Dpeedahnb — Thu, 26 Nov 2020 17:21:35 GMT

wc provides '0 2220 612208' as a response when I run the script myself.
However on splunk the echo returns 0 0 0 as an event

Re: Bash echo command no ingested by splunk, whle others are.

isoutamo — Thu, 26 Nov 2020 20:13:20 GMT

The size of your response is quite much more than max size of shell variable (~32k). This is the reason why it’s didn’t work.
Can you write it to file and then read it there to splunk?