Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Splunk Scripted Inputs ingesting only Headers
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
Splunk is ingesting only a portion of the scripted input ps.sh from my *nix os TA, and I don't know why.
Before a certain date, it was all ingesting fine. After a particular date, it's begun to only ingest the Headers from the script output, rather than the output values themselves:
USER PID PSR pctCPU CPUTIME pctMEM RSZ_KB VSZ_KB TTY S ELAPSED COMMAND ARGS
Has anyone else experienced this before?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Run the script directly in the server and check whether we are getting the output properly. If you are getting an output save to a temp file and check how it is appearing. Each line needs to have separate process details.
sh ps.sh > temp.txt
cat -n temp.txt
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Run the script directly in the server and check whether we are getting the output properly. If you are getting an output save to a temp file and check how it is appearing. Each line needs to have separate process details.
sh ps.sh > temp.txt
cat -n temp.txt
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, did this and it led me to investigate props.conf on HF's that was having issues.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is for "Splunk Add-on for Unix and Linux" version 8.0.0
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
How to find the worst searches in your Splunk environment and how to fix them
Share Your Feedback: On Admin Config Service (ACS)!
Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon
