Getting Data In

Why am I seeing inconsistent data using scripted inputs?

dilipbailwal
Path Finder

I am calling vbs script as scripted input in inputs.conf, after which I can see data for most of the servers, but for some servers data seems to be only showing first two lines of the content, and hence eliminating the whole set of approx. 90-100 lines. After manually checking script output on one of the boxes, data seems to be appropriate which means the script is working fine and splunk is failing to consume all the content..

For Eg,

Client,5.1.b.20100114R (Registered Version),N/A;
Testtools,2.0.1,N/A;
Microsoft Visual C++ 2005 Redistributable (x64),N/A,09-05-2013;
Microsoft Network Monitor 3.4,3.4.2350.0,09-05-2013;
Microsoft .NET Framework 4.5.1,4.5.50938,09-05-2013;
Microsoft Network Monitor: NetworkMonitor Parsers 3.4,3.4.2350.0,09-05-2013;

for some servers its showing only,
Time Client,5.1.b.20100114R (Registered Version),N/A;
Microsoft Network Monitor 3.4,3.4.2350.0,09-05-2013;

and nothing much. After checking splunkd.log and metrics.log, i don't see any errors for it.

Tags (1)
0 Karma
1 Solution

MuS
Legend

Hi dilipbailwal,

enable all possible debugging features in your script and output that into a log.
Check that log for any errors. I assume that there is some strange hidden/special character in the output/result.

Take a look at the docs about the script output format as well http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptWriting#Format_script_output

cheers, MuS

View solution in original post

MuS
Legend

Hi dilipbailwal,

enable all possible debugging features in your script and output that into a log.
Check that log for any errors. I assume that there is some strange hidden/special character in the output/result.

Take a look at the docs about the script output format as well http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptWriting#Format_script_output

cheers, MuS

dilipbailwal
Path Finder

Thanks Mus,
After 2 hrs of going thru code, i figure out the issue was with following date format,
Thu May 22 12:47:46 EDT 2014
and to be precise, it was with the colon within date.

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...