How to re-direct error messages from scripted inpu...

Getting Data In

I have a scripted input, which run the command ntpstat and the results are sent to os Index.

When the ntp daemon is not running, there is an error message of "Unable to talk to NTP daemon. Is it running?", which gets indexed to _internal.

Is there away to re-direct error messages to the os Index?

Get Updates on the Splunk Community!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with this month’s ...

Are you a member of the Splunk Community?