Your example did work for me so I guess maybe it's my script. I adjusted my .conf regardless but still nothing. No idea what the issue may be. ---REVISED --- inputs.conf [script://$SPLUNK_HOME/etc/apps/TA-HackerOne/bin/hacker_one_pull.sh]
disabled = false
index = test
interval = 180.0
sourcetype = h1:json props.conf [h1:json]
DATETIME_CONFIG=CURRENT
INDEXED_EXTRACTIONS=json
KV_MODE=none
LINE_BREAKER=([\r\n]+) data sample -bash-4.2$ pwd
/opt/splunk/etc/apps/TA-HackerOne/bin
-bash-4.2$ ./hacker_one_pull.sh
{
"id": "49",
"type": "report",
"attributes": {
"name": "Lorem Ipsum",
"description": "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.",
"external_id": "aaa-123",
"created_at": "2018-02-27T16:48:23.308Z"
}
}
{
"id": "20",
"type": "report",
"attributes": {
"name": "Finibus Bonorum",
"description": "Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium.",
"external_id": "aaa-726",
"created_at": "2019-09-11T08:26:14.625Z"
}
}
-bash-4.2$ This shows up in _internal (but only once, never again) 08-29-2020 20:01:04.689 +0000 INFO ExecProcessor - New scheduled exec process: /opt/splunk/etc/apps/TA-HackerOne/bin/hacker_one_pull.sh
... View more