Why am I seeing inconsistent data using scripted inputs?

[dilipbailwal]

I am calling vbs script as scripted input in inputs.conf, after which I can see data for most of the servers, but for some servers data seems to be only showing first two lines of the content, and hence eliminating the whole set of approx. 90-100 lines. After manually checking script output on one of the boxes, data seems to be appropriate which means the script is working fine and splunk is failing to consume all the content..

For Eg,

Client,5.1.b.20100114R (Registered Version),N/A;
Testtools,2.0.1,N/A;
Microsoft Visual C++ 2005 Redistributable (x64),N/A,09-05-2013;
Microsoft Network Monitor 3.4,3.4.2350.0,09-05-2013;
Microsoft .NET Framework 4.5.1,4.5.50938,09-05-2013;
Microsoft Network Monitor: NetworkMonitor Parsers 3.4,3.4.2350.0,09-05-2013;

for some servers its showing only,
Time Client,5.1.b.20100114R (Registered Version),N/A;
Microsoft Network Monitor 3.4,3.4.2350.0,09-05-2013;

and nothing much. After checking splunkd.log and metrics.log, i don't see any errors for it.

[MuS · Accepted solution]

Hi dilipbailwal,

enable all possible debugging features in your script and output that into a log.
Check that log for any errors. I assume that there is some strange hidden/special character in the output/result.

Take a look at the docs about the script output format as well http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptWriting#Format_script_output

cheers, MuS

[dilipbailwal]

Thanks Mus,
After 2 hrs of going thru code, i figure out the issue was with following date format,
Thu May 22 12:47:46 EDT 2014
and to be precise, it was with the colon within date.