Getting Data In
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

How to re-direct error messages from scripted input from _internal to a different Index?


I have a scripted input, which run the command ntpstat and the results are sent to os Index.

When the ntp daemon is not running, there is an error message of "Unable to talk to NTP daemon. Is it running?", which gets indexed to _internal.

Is there away to re-direct error messages to the os Index?

Labels (2)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!