Getting Data In

Splunk Scripted Inputs ingesting only Headers

rmccullagh
Explorer

Hi All,

Splunk is ingesting only a portion of the scripted input ps.sh from my *nix os TA, and I don't know why.

Before a certain date, it was all ingesting fine. After a particular date, it's begun to only ingest the Headers from the script output, rather than the output values themselves:

 

USER               PID   PSR   pctCPU       CPUTIME  pctMEM     RSZ_KB     VSZ_KB   TTY      S       ELAPSED  COMMAND             ARGS

 

Has anyone else experienced this before? 

Labels (2)
0 Karma
1 Solution

saravanan90
Contributor

Run the script directly in the server and check whether we are getting the output properly. If you are getting an output save to a temp file and check how it is appearing. Each line needs to have separate process details.

sh ps.sh > temp.txt

cat -n temp.txt

 

View solution in original post

0 Karma

saravanan90
Contributor

Run the script directly in the server and check whether we are getting the output properly. If you are getting an output save to a temp file and check how it is appearing. Each line needs to have separate process details.

sh ps.sh > temp.txt

cat -n temp.txt

 

0 Karma

rmccullagh
Explorer

Thanks, did this and it led me to investigate props.conf on HF's that was having issues.

0 Karma

rmccullagh
Explorer

This is for "Splunk Add-on for Unix and Linux" version 8.0.0

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...