How to re-direct error messages from scripted inpu...

Getting Data In

I have a scripted input, which run the command ntpstat and the results are sent to os Index.

When the ntp daemon is not running, there is an error message of "Unable to talk to NTP daemon. Is it running?", which gets indexed to _internal.

Is there away to re-direct error messages to the os Index?

Get Updates on the Splunk Community!

Long before a new capability reaches the keynote stage, it begins as an idea waiting to be tested. At ...

Why Universal Forwarders Should Not Be Used as Intermediate Forwarders A practical Splunk forwarding topology ...

Data Management Digest Welcome to the August 2026 edition of Data Management Digest! August was a big month ...

How to re-direct error messages from scripted input from _internal to a different Index?