Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Scripted Input and not working well with linux...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Guys,
Am i not sure if anyone has a solution for this.
But I am not able to get any output when i run the linux find command with the "-ls" flag through a script.
find . -maxdepth 1 -type f -name "*.xml" -mmin 600 -ls
Running the "find" command without "ls" flag seem to work fine
find . -maxdepth 1 -type f -name "*.xml" -mmin 600
Is there some sort of limitations when it comes to scripted inputs
Sam
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How have you defined timestamping for this sourcetype? The -ls option means the output includes a timestamp. Depending on your settings, splunk could be dropping these events entirely (if the timestamp is too far astray from current time), or indexing them with a timestamp wildly different from your expectations.
I would change the props.conf settings for this sourcetype to force CURRENT time only, if you haven't already.
[your_find_command_sourcetype]
DATETIME_CONFIG = CURRENT
...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How have you defined timestamping for this sourcetype? The -ls option means the output includes a timestamp. Depending on your settings, splunk could be dropping these events entirely (if the timestamp is too far astray from current time), or indexing them with a timestamp wildly different from your expectations.
I would change the props.conf settings for this sourcetype to force CURRENT time only, if you haven't already.
[your_find_command_sourcetype]
DATETIME_CONFIG = CURRENT
...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks twinspop , that solved it .
Cheers!!!!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
