Getting Data In

Troubleshooting Scripted Inputs

qix
Engager

Where can I find the error messages generated by scripted inputs?

Tags (1)
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

The error output of scripted inputs is indexed by Splunk in the `_internal` index. You can search the errors with a similar search to the following:

index="_internal" error myscript.sh

You should see notices that look like `ERROR ExecProcessor`, followed by the script path/name.

This data is also kept in `$SPLUNK_HOME/var/log/splunk/splunkd.log`.

View solution in original post

Ron_Naken
Splunk Employee
Splunk Employee

The error output of scripted inputs is indexed by Splunk in the `_internal` index. You can search the errors with a similar search to the following:

index="_internal" error myscript.sh

You should see notices that look like `ERROR ExecProcessor`, followed by the script path/name.

This data is also kept in `$SPLUNK_HOME/var/log/splunk/splunkd.log`.

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...