Getting Data In

Splunk unix app not receiving inputs

remy06
Contributor

Hi,

I've enabled some of the inputs for the unix app via its configuration page.After selecting those inputs to be enabled,I've saved it but still it doesn't seem to be receiving any inputs.

I've checked again at Manager>Data inputs>Scripts and those input scripts that I've selected are marked as Enabled.

I've also tried restarting Splunk services but no input as well.

Is there something I've missed?

Fyi,splunk is installed on CentOS.

0 Karma
1 Solution

remy06
Contributor

I've did a check on splunkd logs and found number of errors like this:

11-24-2010 10:33:37.162 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/unix/bin/top.sh" /bin/sh: /opt/splunk/etc/apps/unix/bin/top.sh: /bin/sh^M: bad interpreter: No such file or directory

They do exist..

View solution in original post

0 Karma

somchatt78
New Member

above answer did not solve problem, even after manually adding role OS, did not solve the issue

0 Karma

remy06
Contributor

I've did a check on splunkd logs and found number of errors like this:

11-24-2010 10:33:37.162 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/unix/bin/top.sh" /bin/sh: /opt/splunk/etc/apps/unix/bin/top.sh: /bin/sh^M: bad interpreter: No such file or directory

They do exist..

0 Karma

mikelanghorst
Motivator

From your log output, you show "/bin/sh^M". Did you copy the files from another non unix host? It looks like you may have a dos->unix file translation issue. Go to /opt/splunk/etc/apps/unix and "dos2unix top.sh" and see if that clears that error message.

0 Karma

remy06
Contributor

Any idea on this??

0 Karma

bwooden
Splunk Employee
Splunk Employee

By default, the Nix app will store its data in the OS index.

You may need to add "index=os" to the beginning of your search as well.

You could also add OS to the list of selected roles via the Manager -> Access controls -> Roles.

0 Karma

remy06
Contributor

When I do a search for index=os,nothing shows up.
When I'm at the Over>About Splunk for Unix page, there is still no Hosts,Sourcetypes and Sources listed.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...