topic How to re-direct error messages from scripted input from _internal to a different Index? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-re-direct-error-messages-from-scripted-input-from/m-p/551624#M91550 <P>I have a scripted input, which run the command ntpstat and the results are sent to os Index.</P><P>When the ntp daemon is not running, there is an error message of "<EM><SPAN class="t">Unable</SPAN> <SPAN class="t">to</SPAN> <SPAN class="t">talk</SPAN> <SPAN class="t">to</SPAN> <SPAN class="t a"><SPAN class="t">NTP</SPAN></SPAN> <SPAN class="t">daemon.</SPAN> <SPAN class="t">Is</SPAN> <SPAN class="t">it</SPAN> </EM><SPAN class="t"><EM>running?</EM>", which gets indexed to _internal.</SPAN></P><P>Is there away to re-direct error messages to the os Index?</P> Fri, 14 May 2021 15:54:02 GMT arthurva 2021-05-14T15:54:02Z How to re-direct error messages from scripted input from _internal to a different Index? https://community.splunk.com/t5/Getting-Data-In/How-to-re-direct-error-messages-from-scripted-input-from/m-p/551624#M91550 <P>I have a scripted input, which run the command ntpstat and the results are sent to os Index.</P><P>When the ntp daemon is not running, there is an error message of "<EM><SPAN class="t">Unable</SPAN> <SPAN class="t">to</SPAN> <SPAN class="t">talk</SPAN> <SPAN class="t">to</SPAN> <SPAN class="t a"><SPAN class="t">NTP</SPAN></SPAN> <SPAN class="t">daemon.</SPAN> <SPAN class="t">Is</SPAN> <SPAN class="t">it</SPAN> </EM><SPAN class="t"><EM>running?</EM>", which gets indexed to _internal.</SPAN></P><P>Is there away to re-direct error messages to the os Index?</P> Fri, 14 May 2021 15:54:02 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-re-direct-error-messages-from-scripted-input-from/m-p/551624#M91550 arthurva 2021-05-14T15:54:02Z