Hi Guys,
Am i not sure if anyone has a solution for this.
But I am not able to get any output when i run the linux find command with the "-ls" flag through a script.
find . -maxdepth 1 -type f -name "*.xml" -mmin 600 -ls
Running the "find" command without "ls" flag seem to work fine
find . -maxdepth 1 -type f -name "*.xml" -mmin 600
Is there some sort of limitations when it comes to scripted inputs
Sam
How have you defined timestamping for this sourcetype? The -ls
option means the output includes a timestamp. Depending on your settings, splunk could be dropping these events entirely (if the timestamp is too far astray from current time), or indexing them with a timestamp wildly different from your expectations.
I would change the props.conf
settings for this sourcetype to force CURRENT time only, if you haven't already.
[your_find_command_sourcetype]
DATETIME_CONFIG = CURRENT
...
How have you defined timestamping for this sourcetype? The -ls
option means the output includes a timestamp. Depending on your settings, splunk could be dropping these events entirely (if the timestamp is too far astray from current time), or indexing them with a timestamp wildly different from your expectations.
I would change the props.conf
settings for this sourcetype to force CURRENT time only, if you haven't already.
[your_find_command_sourcetype]
DATETIME_CONFIG = CURRENT
...
Thanks twinspop , that solved it .
Cheers!!!!