Getting Data In
Highlighted

Scripted input not showing up in search results

Communicator

env[home] = linux, centos, splunk 4.0.11, everything on one test box

cat /opt/splunk/etc/apps/unix/bin/uname.sh

#!/bin/sh 
uname -a

cat etc/apps/unix/local/inputs.conf

[script:///opt/splunk/etc/apps/unix/bin/uname.sh]
disabled = false
index = os
interval = 30
sourcetype = uname

I've set the interval pretty low just to get the script to execute but it isn't working. File permissions are 755 on that file and other scripted inputs work fine. Any ideas? Any logs to check?

Also, if I search _internal for per_sourcetype_thruput, entries for this sourcetype are returning non-zero values so Splunk is doing something with it...

There are no errors related the file not existing or not being under $SPLUNK_HOME...

0 Karma
Highlighted

Re: Scripted input not showing up in search results

Splunk Employee
Splunk Employee

how do you know it is not working? - ie. what is your search query that gives you this impression?
basically, make sure that index=os is part of your search, otherwise you might not see it (if youre just doing a search on sourcetype=uname)

0 Karma
Highlighted

Re: Scripted input not showing up in search results

Splunk Employee
Splunk Employee

If you just log in as the Splunk user and run the script using $SPLUNK_HOME/bin/splunk cmd /opt/splunk/etc/apps/unix/bin/uname.sh, does it produce the output you expect? Is the os index specifically being searched?

0 Karma
Highlighted

Re: Scripted input not showing up in search results

Super Champion

Any errors reported with this search? index="_internal" ExecProcessor sourcetype="splunkd" ERROR

0 Karma
Highlighted

Re: Scripted input not showing up in search results

Communicator

I was including index=os, the command runs fine, and no errors were returned in that search. Hmm.

0 Karma
Highlighted

Re: Scripted input not showing up in search results

Super Champion

Hmmm, what timerange are you running your search for?

When I run uname -a I get the following output:

Linux linuxbox2 2.6.24-27-server #1 SMP Mon Feb 22 19:42:25 UTC 2010 i686 GNU/Linux

Make sure you are preventing that kernel build time from being picked up as your event's timestamp. I believe you can do that with the following props.conf entry:

[uname]
DATETIME_CONFIG = CURRENT

View solution in original post

Highlighted

Re: Scripted input not showing up in search results

Communicator

Thanks, facepalm

0 Karma