Getting Data In

Scripted Input and not working well with linux "Find" Command

samaikins
New Member

Hi Guys,
Am i not sure if anyone has a solution for this.
But I am not able to get any output when i run the linux find command with the "-ls" flag through a script.

find . -maxdepth 1 -type f -name "*.xml" -mmin 600 -ls 

Running the "find" command without "ls" flag seem to work fine

find . -maxdepth 1 -type f -name "*.xml" -mmin 600 

Is there some sort of limitations when it comes to scripted inputs

Sam

Tags (1)
0 Karma
1 Solution

twinspop
Influencer

How have you defined timestamping for this sourcetype? The -ls option means the output includes a timestamp. Depending on your settings, splunk could be dropping these events entirely (if the timestamp is too far astray from current time), or indexing them with a timestamp wildly different from your expectations.

I would change the props.conf settings for this sourcetype to force CURRENT time only, if you haven't already.

[your_find_command_sourcetype]
DATETIME_CONFIG = CURRENT
...

View solution in original post

0 Karma

twinspop
Influencer

How have you defined timestamping for this sourcetype? The -ls option means the output includes a timestamp. Depending on your settings, splunk could be dropping these events entirely (if the timestamp is too far astray from current time), or indexing them with a timestamp wildly different from your expectations.

I would change the props.conf settings for this sourcetype to force CURRENT time only, if you haven't already.

[your_find_command_sourcetype]
DATETIME_CONFIG = CURRENT
...

View solution in original post

0 Karma

samaikins
New Member

Thanks twinspop , that solved it .
Cheers!!!!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!