Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Splunk unix app not receiving inputs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I've enabled some of the inputs for the unix app via its configuration page.After selecting those inputs to be enabled,I've saved it but still it doesn't seem to be receiving any inputs.
I've checked again at Manager>Data inputs>Scripts and those input scripts that I've selected are marked as Enabled.
I've also tried restarting Splunk services but no input as well.
Is there something I've missed?
Fyi,splunk is installed on CentOS.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've did a check on splunkd logs and found number of errors like this:
11-24-2010 10:33:37.162 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/unix/bin/top.sh" /bin/sh: /opt/splunk/etc/apps/unix/bin/top.sh: /bin/sh^M: bad interpreter: No such file or directory
They do exist..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
above answer did not solve problem, even after manually adding role OS, did not solve the issue
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've did a check on splunkd logs and found number of errors like this:
11-24-2010 10:33:37.162 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/unix/bin/top.sh" /bin/sh: /opt/splunk/etc/apps/unix/bin/top.sh: /bin/sh^M: bad interpreter: No such file or directory
They do exist..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
From your log output, you show "/bin/sh^M". Did you copy the files from another non unix host? It looks like you may have a dos->unix file translation issue. Go to /opt/splunk/etc/apps/unix and "dos2unix top.sh" and see if that clears that error message.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Any idea on this??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
By default, the Nix app will store its data in the OS index.
You may need to add "index=os" to the beginning of your search as well.
You could also add OS to the list of selected roles via the Manager -> Access controls -> Roles.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When I do a search for index=os,nothing shows up.
When I'm at the Over>About Splunk for Unix page, there is still no Hosts,Sourcetypes and Sources listed.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
