Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Splunk Scripted Inputs ingesting only Headers
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
Splunk is ingesting only a portion of the scripted input ps.sh from my *nix os TA, and I don't know why.
Before a certain date, it was all ingesting fine. After a particular date, it's begun to only ingest the Headers from the script output, rather than the output values themselves:
USER PID PSR pctCPU CPUTIME pctMEM RSZ_KB VSZ_KB TTY S ELAPSED COMMAND ARGS
Has anyone else experienced this before?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Run the script directly in the server and check whether we are getting the output properly. If you are getting an output save to a temp file and check how it is appearing. Each line needs to have separate process details.
sh ps.sh > temp.txt
cat -n temp.txt
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Run the script directly in the server and check whether we are getting the output properly. If you are getting an output save to a temp file and check how it is appearing. Each line needs to have separate process details.
sh ps.sh > temp.txt
cat -n temp.txt
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, did this and it led me to investigate props.conf on HF's that was having issues.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is for "Splunk Add-on for Unix and Linux" version 8.0.0
Splunk Observability for AI
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Splunk Observability as Code: From Zero to Dashboard
