Where can I find the error messages generated by scripted inputs?
The error output of scripted inputs is indexed by Splunk in the `_internal` index. You can search the errors with a similar search to the following:
index="_internal" error myscript.sh
You should see notices that look like `ERROR ExecProcessor`, followed by the script path/name.
This data is also kept in `$SPLUNK_HOME/var/log/splunk/splunkd.log`.
View solution in original post