Getting Data In

Why is my "/usr/bin/last" script not working?

karakutu
Path Finder

i have problem with my basic script.

ist connnten only

#!/bin/sh

/usr/bin/last

i updated also my default/inputs.conf below:

[script://./bin/who.sh]
interval = */1 * * * *
index = main
sourcetype = who

but i can not find the out put of it.

when i delete the /usr/bin/last line and add such echo "test"; it works!!

how can i fix this problem? i know that my script works, but Splunk can not parse it.

0 Karma

FritzWittwer
Contributor

So the script works, but timestamp and event breaking fails. As long as you don't remove the colons Splunk will use the default settings and recognise this timestamps and brake the events there.
There are various ways to fix it, but the laziest one would be to look at the Splunk Add-on for Unix, or at least the definition of the scripted input and the lastlog stanza from the props.conf.

0 Karma

karakutu
Path Finder

when i change the scipt following its work again

so there is something wrong with the time

/usr/bin/last   | sed  's/:/./g'

root     tty1                          Mon Apr 25 13.24 - 13.26  (00.01)
0 Karma

karakutu
Path Finder

i dont know how. but after i extract a couple of field of log. splunk begin to recognise the logs

thanks

0 Karma

FritzWittwer
Contributor

Try to run the script from the command line as the user under wich Splunk is running, Splunk should index what you see as output there. Output which is written to standard error goes to the splunkd.log.

0 Karma

karakutu
Path Finder

i checked the splunkd.logs but i can do it again.
on the log i can see only that the script is executed

when i change the script content like below:

/usr/bin/last  | awk  -F: '{ print $1 }'

i can find it at the splunk server site. i think something wrong with parsing.

0 Karma

karakutu
Path Finder

how can i debug such a problem. when i change the content of the script splunk index it.

but i can not index the output of /usr/bin/last

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Have you checked splunkd.log for any hints as to what may be going wrong?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!