Getting Data In

Scripted Input and not working well with linux "Find" Command

samaikins
New Member

Hi Guys,
Am i not sure if anyone has a solution for this.
But I am not able to get any output when i run the linux find command with the "-ls" flag through a script.

find . -maxdepth 1 -type f -name "*.xml" -mmin 600 -ls 

Running the "find" command without "ls" flag seem to work fine

find . -maxdepth 1 -type f -name "*.xml" -mmin 600 

Is there some sort of limitations when it comes to scripted inputs

Sam

Tags (1)
0 Karma
1 Solution

twinspop
Influencer

How have you defined timestamping for this sourcetype? The -ls option means the output includes a timestamp. Depending on your settings, splunk could be dropping these events entirely (if the timestamp is too far astray from current time), or indexing them with a timestamp wildly different from your expectations.

I would change the props.conf settings for this sourcetype to force CURRENT time only, if you haven't already.

[your_find_command_sourcetype]
DATETIME_CONFIG = CURRENT
...

View solution in original post

0 Karma

twinspop
Influencer

How have you defined timestamping for this sourcetype? The -ls option means the output includes a timestamp. Depending on your settings, splunk could be dropping these events entirely (if the timestamp is too far astray from current time), or indexing them with a timestamp wildly different from your expectations.

I would change the props.conf settings for this sourcetype to force CURRENT time only, if you haven't already.

[your_find_command_sourcetype]
DATETIME_CONFIG = CURRENT
...
0 Karma

samaikins
New Member

Thanks twinspop , that solved it .
Cheers!!!!

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...