topic Scripted Input and not working well with linux "Find" Command in Getting Data In

Scripted Input and not working well with linux "Find" Command

samaikins — Mon, 11 Apr 2016 03:34:47 GMT

Hi Guys,
Am i not sure if anyone has a solution for this.
But I am not able to get any output when i run the linux find command with the "-ls" flag through a script.

find . -maxdepth 1 -type f -name "*.xml" -mmin 600 -ls

Running the "find" command without "ls" flag seem to work fine

find . -maxdepth 1 -type f -name "*.xml" -mmin 600

Is there some sort of limitations when it comes to scripted inputs

Sam

Re: Scripted Input and not working well with linux "Find" Command

twinspop — Mon, 11 Apr 2016 14:33:34 GMT

How have you defined timestamping for this sourcetype? The -ls option means the output includes a timestamp. Depending on your settings, splunk could be dropping these events entirely (if the timestamp is too far astray from current time), or indexing them with a timestamp wildly different from your expectations.

I would change the props.conf settings for this sourcetype to force CURRENT time only, if you haven't already.

[your_find_command_sourcetype]
DATETIME_CONFIG = CURRENT
...

Re: Scripted Input and not working well with linux "Find" Command

samaikins — Tue, 12 Apr 2016 09:38:26 GMT

Thanks twinspop , that solved it .
Cheers!!!!