Scripted Inputs not functioning

[KyleH]

I've configured three bash scripts, all of which do essentially the same exact thing.

1. Run a command and send the output to a file

2. Parse this file via a Python script (Which then prints the parsed file to the console, sending it to Splunk)

3. Delete the file

Two of the three scripts work exactly as intended, with no issues whatsoever. The third, however, sends no information to Splunk at all. I can run the python portion independently, the bash script w/ the python script, and both can, additionally, be done through'/opt/splunkforwarder/bin/splunk cmd', and, in all instances, it provides the desired output to the cmd line without it being ingested.

If I alter the script and purposefully put in errors they will appear in the _internal index. Aside from that, nothing related to issues with the script appears there.

All of the scripts are set up in the exact same manner in the inputs.conf file, with them all using the same source-type and index. 

Any guidance on how to proceed with the troubleshooting would be greatly appreciated!

[gcusello]

Hi @KyleH ,

at first you don't need to write the script results in a file, but you can directly send script output to Splunk (as you can see at https://docs.splunk.com/Documentation/Splunk/8.0.4/AdvancedDev/ScriptedInputsIntro ).

Then the only hint I can give you is to test the script by itself:

• does it give results or not?
• has the user you're using for Splunk the grants to execute that script and access the files?

Ciao.

Giuseppe