How to re-direct error messages from scripted inpu...

Getting Data In

I have a scripted input, which run the command ntpstat and the results are sent to os Index.

When the ntp daemon is not running, there is an error message of "Unable to talk to NTP daemon. Is it running?", which gets indexed to _internal.

Is there away to re-direct error messages to the os Index?

Get Updates on the Splunk Community!

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Data Drivers: Every Lap Tells a Story The Spectacle Two F1 racing sims go head-to-head on the .conf26 show ...

How to re-direct error messages from scripted input from _internal to a different Index?