Getting Data In

Scripted Input and not working well with linux "Find" Command

samaikins
New Member

Hi Guys,
Am i not sure if anyone has a solution for this.
But I am not able to get any output when i run the linux find command with the "-ls" flag through a script.

find . -maxdepth 1 -type f -name "*.xml" -mmin 600 -ls 

Running the "find" command without "ls" flag seem to work fine

find . -maxdepth 1 -type f -name "*.xml" -mmin 600 

Is there some sort of limitations when it comes to scripted inputs

Sam

Tags (1)
0 Karma
1 Solution

twinspop
Influencer

How have you defined timestamping for this sourcetype? The -ls option means the output includes a timestamp. Depending on your settings, splunk could be dropping these events entirely (if the timestamp is too far astray from current time), or indexing them with a timestamp wildly different from your expectations.

I would change the props.conf settings for this sourcetype to force CURRENT time only, if you haven't already.

[your_find_command_sourcetype]
DATETIME_CONFIG = CURRENT
...

View solution in original post

0 Karma

twinspop
Influencer

How have you defined timestamping for this sourcetype? The -ls option means the output includes a timestamp. Depending on your settings, splunk could be dropping these events entirely (if the timestamp is too far astray from current time), or indexing them with a timestamp wildly different from your expectations.

I would change the props.conf settings for this sourcetype to force CURRENT time only, if you haven't already.

[your_find_command_sourcetype]
DATETIME_CONFIG = CURRENT
...
0 Karma

samaikins
New Member

Thanks twinspop , that solved it .
Cheers!!!!

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...