Troubleshooting Scripted Inputs

[qix]

Where can I find the error messages generated by scripted inputs?

[Ron_Naken · Accepted solution]

The error output of scripted inputs is indexed by Splunk in the `_internal` index. You can search the errors with a similar search to the following:

index="_internal" error myscript.sh

You should see notices that look like `ERROR ExecProcessor`, followed by the script path/name.

This data is also kept in `$SPLUNK_HOME/var/log/splunk/splunkd.log`.