Splunk Scripted Inputs ingesting only Headers

[rmccullagh]

Hi All,

Splunk is ingesting only a portion of the scripted input ps.sh from my *nix os TA, and I don't know why.

Before a certain date, it was all ingesting fine. After a particular date, it's begun to only ingest the Headers from the script output, rather than the output values themselves:

USER               PID   PSR   pctCPU       CPUTIME  pctMEM     RSZ_KB     VSZ_KB   TTY      S       ELAPSED  COMMAND             ARGS

Has anyone else experienced this before? 

[saravanan90 · Accepted solution]

Run the script directly in the server and check whether we are getting the output properly. If you are getting an output save to a temp file and check how it is appearing. Each line needs to have separate process details.

sh ps.sh > temp.txt

cat -n temp.txt

[rmccullagh]

Thanks, did this and it led me to investigate props.conf on HF's that was having issues.

[rmccullagh]

This is for "Splunk Add-on for Unix and Linux" version 8.0.0