I would suggest to produce the csv instead of stdout. If you lose any network connectivity the data you are trying to run thought stdout can be lost, if you do not have any buffer to store this data. According to the Splunk Administration manual, this is the only the downside of using scripting inputs. "One possible downside to scripted input is potential loss of data – Example: the forwarder that is running the script is not able to connect to the indexer due to networking problems". ... View more