How to re-direct error messages from scripted inpu...

Getting Data In

I have a scripted input, which run the command ntpstat and the results are sent to os Index.

When the ntp daemon is not running, there is an error message of "Unable to talk to NTP daemon. Is it running?", which gets indexed to _internal.

Is there away to re-direct error messages to the os Index?

Get Updates on the Splunk Community!

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...

Introduction Raw telemetry is often incomplete. A log line might record an IP address, but what you really ...

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...

How to re-direct error messages from scripted input from _internal to a different Index?