Scripted input not showing up in search results

[oreoshake]

env[home] = linux, centos, splunk 4.0.11, everything on one test box

cat /opt/splunk/etc/apps/unix/bin/uname.sh

#!/bin/sh 
uname -a

cat etc/apps/unix/local/inputs.conf

[script:///opt/splunk/etc/apps/unix/bin/uname.sh]
disabled = false
index = os
interval = 30
sourcetype = uname

I've set the interval pretty low just to get the script to execute but it isn't working. File permissions are 755 on that file and other scripted inputs work fine. Any ideas? Any logs to check?

Also, if I search _internal for per_sourcetype_thruput, entries for this sourcetype are returning non-zero values so Splunk is doing something with it...

There are no errors related the file not existing or not being under $SPLUNK_HOME...

[Lowell · Accepted solution]

Hmmm, what timerange are you running your search for?

When I run uname -a I get the following output:

Linux linuxbox2 2.6.24-27-server #1 SMP Mon Feb 22 19:42:25 UTC 2010 i686 GNU/Linux

Make sure you are preventing that kernel build time from being picked up as your event's timestamp. I believe you can do that with the following props.conf entry:

[uname]
DATETIME_CONFIG = CURRENT

[oreoshake]

Thanks, facepalm

[oreoshake]

I was including index=os, the command runs fine, and no errors were returned in that search. Hmm.

[Lowell]

Any errors reported with this search? index="_internal" ExecProcessor sourcetype="splunkd" ERROR

[gkanapathy]

If you just log in as the Splunk user and run the script using $SPLUNK_HOME/bin/splunk cmd /opt/splunk/etc/apps/unix/bin/uname.sh, does it produce the output you expect? Is the os index specifically being searched?

[Genti]

how do you know it is not working? - ie. what is your search query that gives you this impression?
basically, make sure that index=os is part of your search, otherwise you might not see it (if youre just doing a search on sourcetype=uname)