Getting Data In

Bash echo command no ingested by splunk, whle others are.

Dpeedahnb
Explorer

I have these as the final lines of my bash script:

response=$(curl -H "Authorization: Bearer $access_token" -H "Accept: application/json;odata=verbose" -s "$url")
echo "$response"

echo "Test1"

The script runs, however only 'Test 1' is sent to the index/splunk.
My response, which I know returns the response of the curl command, seems to be being ignored. The only reason I can think for this is that it's too large a body?
The response is in json but is quite large, I'd say pages worth.

Labels (4)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
To se if you get anything what you are expecting just add “ | wc “ inside response evaluation.
0 Karma

Dpeedahnb
Explorer

wc provides '0 2220 612208' as a response when I run the script myself.
However on splunk the echo returns  0 0 0 as an event

0 Karma

isoutamo
SplunkTrust
SplunkTrust
The size of your response is quite much more than max size of shell variable (~32k). This is the reason why it’s didn’t work.
Can you write it to file and then read it there to splunk?
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Anything helpful in splunkd.log?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...