Getting Data In

Why does my scripted input get indexed differently from host to host?

splunk4steve
New Member

I have a one line script that searches the /dev directory for non-device (ie, regular files) on three different Red Hat 5.7 servers. On two of the three I'll get one event with multiple lines. For example, the find command will return 27 results and they get indexed as one event. This is how I expect it to be.

On the 3rd system each line that find returns gets indexed individually and the timestamp of the event looks like it's taken from the data itself - and is not assigned by the indexer.

So, if the three systems are virtually the same why the difference in how things are being indexed?

Tags (2)
0 Karma

somesoni2
Revered Legend

If you're not using a sourcetype with explicit event breaking and/or timestamp recognition, splunk will try to do it based on the data it receives. There may be difference in the output (on 3rd system) causing Splunk to treat the data differently. A good idea will be to explicitly define the eventbreaking and timestamp. See this

http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Setupcustominputs

0 Karma

somesoni2
Revered Legend

Just to be sure, your sourcetype has eventbreaking attributes explicitly mentioned? Also, would be good idea to share some sample outputs which are causing issue (with one which is not causing issue). Sometime its a small thing which we don't see but Splunk does.

0 Karma

splunk4steve
New Member

I have definitely set up a source and sourcetype. Also, the output is exactly the same as on the other machines. It's just the output of an 'ls -l' command.

Very peculiar...

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...