Getting Data In

Why is scripted input only giving the first line?

ericrobinson
Path Finder

I have tried following http://www.splunk.com/base/Documentation/latest/Admin/Setupcustom(scripted)inputs, but I am having no luck. I cant seem to get the BREAK_ONLY_BEFORE to work for me..

My script is basically a wrapper around pkginfo.

It returns package information with each package on a new line.

Please help! Anyone!

Here is the inputs and props.conf located in $SPLUNK_HOME/etc/apps/scripts/default

inputs.conf:
[script://$SPLUNK_HOME/etc/apps/scripts/bin/pi.sh]
interval = 60
sourcetype = pkginfo
source = pkginfo
disabled = 0


props.conf:
[pkginfo]
SHOULD_LINEMERGE = false
LINE_BREAKER = (?!)
Tags (1)
0 Karma

bfaber
Communicator

Can you share the pi.sh that you are calling?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Just set:

SHOULD_LINEMERGE = false
LINE_BREAKER = (?!)

Assuming that your script is called periodically by a cron schedule.

0 Karma

ericrobinson
Path Finder

This is still not working for me unfortunately..

Here is my props.conf

[pkginfo]
SHOULD_LINEMERGE = false
LINE_BREAKER = (?!)

Here is the inputs.conf:

[script://$SPLUNK_HOME/etc/apps/scripts/bin/pi.sh]
interval = 60
sourcetype = pkginfo
source = pkginfo
disabled = 0

These are both in:
$SPLUNK_HOME/etc/apps/scripts/default

0 Karma
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...