Why does my scripted input get indexed differently from host to host?

[splunk4steve]

I have a one line script that searches the /dev directory for non-device (ie, regular files) on three different Red Hat 5.7 servers. On two of the three I'll get one event with multiple lines. For example, the find command will return 27 results and they get indexed as one event. This is how I expect it to be.

On the 3rd system each line that find returns gets indexed individually and the timestamp of the event looks like it's taken from the data itself - and is not assigned by the indexer.

So, if the three systems are virtually the same why the difference in how things are being indexed?

[somesoni2]

If you're not using a sourcetype with explicit event breaking and/or timestamp recognition, splunk will try to do it based on the data it receives. There may be difference in the output (on 3rd system) causing Splunk to treat the data differently. A good idea will be to explicitly define the eventbreaking and timestamp. See this

http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Setupcustominputs

[somesoni2]

Just to be sure, your sourcetype has eventbreaking attributes explicitly mentioned? Also, would be good idea to share some sample outputs which are causing issue (with one which is not causing issue). Sometime its a small thing which we don't see but Splunk does.

[splunk4steve]

I have definitely set up a source and sourcetype. Also, the output is exactly the same as on the other machines. It's just the output of an 'ls -l' command.

Very peculiar...