|
env[home] = linux, centos, splunk 4.0.11, everything on one test box cat /opt/splunk/etc/apps/unix/bin/uname.sh cat etc/apps/unix/local/inputs.conf I've set the interval pretty low just to get the script to execute but it isn't working. File permissions are 755 on that file and other scripted inputs work fine. Any ideas? Any logs to check? Also, if I search _internal for per_sourcetype_thruput, entries for this sourcetype are returning non-zero values so Splunk is doing something with it... There are no errors related the file not existing or not being under $SPLUNK_HOME... |
|
Hmmm, what timerange are you running your search for? When I run Make sure you are preventing that kernel build time from being picked up as your event's timestamp. I believe you can do that with the following props.conf entry: Thanks, facepalm
(03 Jun '10, 20:53)
oreoshake
|
how do you know it is not working? - ie. what is your search query that gives you this impression? basically, make sure that index=os is part of your search, otherwise you might not see it (if youre just doing a search on sourcetype=uname)
If you just log in as the Splunk user and run the script using
$SPLUNK_HOME/bin/splunk cmd /opt/splunk/etc/apps/unix/bin/uname.sh, does it produce the output you expect? Is theosindex specifically being searched?Any errors reported with this search?
index="_internal" ExecProcessor sourcetype="splunkd" ERRORI was including index=os, the command runs fine, and no errors were returned in that search. Hmm.