I am having the same problem in my lab. Here is my inputs.conf file for the nix TA cat /opt/splunk/etc/apps/Splunk_TA_nix/local/inputs.conf [monitor:///etc] disabled = false [monitor:///var/adm] disabled = false [monitor:///home/*/.bash_history] disabled = false [script://./bin/bandwidth.sh] disabled = false [monitor:///root/.bash_history] disabled = false [monitor:///Library/Logs] disabled = false [script://./bin/cpu.sh] disabled = false [script://./bin/df.sh] disabled = false [script://./bin/hardware.sh] disabled = false [script://./bin/interfaces.sh] disabled = false [script://./bin/iostat.sh] disabled = false [script://./bin/lastlog.sh] disabled = false [script://./bin/lsof.sh] disabled = false [script://./bin/netstat.sh] disabled = false [script://./bin/openPorts.sh] disabled = false [script://./bin/openPortsEnhanced.sh] disabled = false [script://./bin/package.sh] disabled = false [script://./bin/passwd.sh] disabled = false [script://./bin/protocol.sh] disabled = false [script://./bin/ps.sh] disabled = false [script://./bin/rlog.sh] disabled = false [script://./bin/selinuxChecker.sh] disabled = false [script://./bin/service.sh] disabled = false [script://./bin/sshdChecker.sh] disabled = false [script://./bin/time.sh] disabled = false [script://./bin/top.sh] disabled = false [script://./bin/update.sh] disabled = false [script://./bin/uptime.sh] disabled = false [script://./bin/usersWithLoginPrivs.sh] disabled = false [script://./bin/version.sh] disabled = false [script://./bin/vmstat.sh] disabled = false [script://./bin/vsftpdChecker.sh] disabled = false [script://./bin/who.sh] disabled = false ... View more