env[home] = linux, centos, splunk 4.0.11, everything on one test box
#!/bin/sh uname -a
[script:///opt/splunk/etc/apps/unix/bin/uname.sh] disabled = false index = os interval = 30 sourcetype = uname
I've set the interval pretty low just to get the script to execute but it isn't working. File permissions are 755 on that file and other scripted inputs work fine. Any ideas? Any logs to check?
Also, if I search _internal for per_sourcetype_thruput, entries for this sourcetype are returning non-zero values so Splunk is doing something with it...
There are no errors related the file not existing or not being under $SPLUNK_HOME...
how do you know it is not working? - ie. what is your search query that gives you this impression?
basically, make sure that index=os is part of your search, otherwise you might not see it (if youre just doing a search on sourcetype=uname)
If you just log in as the Splunk user and run the script using
$SPLUNK_HOME/bin/splunk cmd /opt/splunk/etc/apps/unix/bin/uname.sh, does it produce the output you expect? Is the
os index specifically being searched?
Hmmm, what timerange are you running your search for?
When I run
uname -a I get the following output:
Linux linuxbox2 2.6.24-27-server #1 SMP Mon Feb 22 19:42:25 UTC 2010 i686 GNU/Linux
Make sure you are preventing that kernel build time from being picked up as your event's timestamp. I believe you can do that with the following props.conf entry:
[uname] DATETIME_CONFIG = CURRENT