Can you paste the sample event. You can achieve this by configuring TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD in props.conf ... View more

Not sure if you fixed this. But did you check if there is an inputs.conf under $SPLUNK_HOME/etc/system/local? This will override the inputs.conf settings under your custom application. ... View more

By default the scripted inputs are disabled (disabled = 1). Enable the inputs that you want the add-on to monitor by setting the disabled attribute for each input stanza to 0. Be sure to do this editing under local/inputs.conf ... View more