Scripted Input and not working well with linux "Find" Command

[samaikins]

Hi Guys,
Am i not sure if anyone has a solution for this.
But I am not able to get any output when i run the linux find command with the "-ls" flag through a script.

find . -maxdepth 1 -type f -name "*.xml" -mmin 600 -ls 

Running the "find" command without "ls" flag seem to work fine

find . -maxdepth 1 -type f -name "*.xml" -mmin 600 

Is there some sort of limitations when it comes to scripted inputs

Sam

[twinspop · Accepted solution]

How have you defined timestamping for this sourcetype? The -ls option means the output includes a timestamp. Depending on your settings, splunk could be dropping these events entirely (if the timestamp is too far astray from current time), or indexing them with a timestamp wildly different from your expectations.

I would change the props.conf settings for this sourcetype to force CURRENT time only, if you haven't already.

[your_find_command_sourcetype]
DATETIME_CONFIG = CURRENT
...

[samaikins]

Thanks twinspop , that solved it .
Cheers!!!!