topic Splunk Scripted Inputs ingesting only Headers in Getting Data In

Splunk Scripted Inputs ingesting only Headers

rmccullagh — Tue, 15 Dec 2020 05:12:21 GMT

Hi All,

Splunk is ingesting only a portion of the scripted input ps.sh from my *nix os TA, and I don't know why.

Before a certain date, it was all ingesting fine. After a particular date, it's begun to only ingest the Headers from the script output, rather than the output values themselves:

USER PID PSR pctCPU CPUTIME pctMEM RSZ_KB VSZ_KB TTY S ELAPSED COMMAND ARGS

Has anyone else experienced this before?

Re: Splunk Scripted Inputs ingesting only Headers

rmccullagh — Wed, 16 Dec 2020 05:00:13 GMT

This is for "Splunk Add-on for Unix and Linux" version 8.0.0

Re: Splunk Scripted Inputs ingesting only Headers

saravanan90 — Wed, 16 Dec 2020 08:34:01 GMT

Run the script directly in the server and check whether we are getting the output properly. If you are getting an output save to a temp file and check how it is appearing. Each line needs to have separate process details.

sh ps.sh > temp.txt

cat -n temp.txt

Re: Splunk Scripted Inputs ingesting only Headers

rmccullagh — Fri, 18 Dec 2020 00:37:32 GMT

Thanks, did this and it led me to investigate props.conf on HF's that was having issues.