Getting Data In
Highlighted

Troubleshooting Scripted Inputs

Engager

Where can I find the error messages generated by scripted inputs?

Tags (1)

Re: Troubleshooting Scripted Inputs

Splunk Employee
Splunk Employee

The error output of scripted inputs is indexed by Splunk in the `_internal` index. You can search the errors with a similar search to the following:

index="_internal" error myscript.sh

You should see notices that look like `ERROR ExecProcessor`, followed by the script path/name.

This data is also kept in `$SPLUNK_HOME/var/log/splunk/splunkd.log`.

View solution in original post