Getting Data In
Highlighted

Why does my scripted input get indexed differently from host to host?

New Member

I have a one line script that searches the /dev directory for non-device (ie, regular files) on three different Red Hat 5.7 servers. On two of the three I'll get one event with multiple lines. For example, the find command will return 27 results and they get indexed as one event. This is how I expect it to be.

On the 3rd system each line that find returns gets indexed individually and the timestamp of the event looks like it's taken from the data itself - and is not assigned by the indexer.

So, if the three systems are virtually the same why the difference in how things are being indexed?

Tags (2)
0 Karma
Highlighted

Re: Why does my scripted input get indexed differently from host to host?

SplunkTrust
SplunkTrust

If you're not using a sourcetype with explicit event breaking and/or timestamp recognition, splunk will try to do it based on the data it receives. There may be difference in the output (on 3rd system) causing Splunk to treat the data differently. A good idea will be to explicitly define the eventbreaking and timestamp. See this

http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Setupcustominputs

0 Karma
Highlighted

Re: Why does my scripted input get indexed differently from host to host?

New Member

I have definitely set up a source and sourcetype. Also, the output is exactly the same as on the other machines. It's just the output of an 'ls -l' command.

Very peculiar...

0 Karma
Highlighted

Re: Why does my scripted input get indexed differently from host to host?

SplunkTrust
SplunkTrust

Just to be sure, your sourcetype has eventbreaking attributes explicitly mentioned? Also, would be good idea to share some sample outputs which are causing issue (with one which is not causing issue). Sometime its a small thing which we don't see but Splunk does.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.