Getting Data In

Scripted wtmp input rejected as Binary file

Flynt
Splunk Employee
Splunk Employee

I have a script that pulls wtmp information and saves it to ASCII files but Splunk still insists that my files are binary. In fact, any files I now put in the directory are now considered binary files and cannot be indexed! My config

[monitor:///mylogs/wtmp_logs]
disabled = false
sourcetype = wtmp
crcSalt =

Tags (3)
1 Solution

Flynt
Splunk Employee
Splunk Employee

The issue here is the wtmp sourcetype you have defined in the inputs.conf. Splunk will reject the wtmp sourcetype and consider the files binary. Changing the sourcetype to wtmp_log or wtmplogs will solve the issue and allow indexing of files within this directory.

View solution in original post

praveerg
New Member

Can i get the script to read wtmp file and converts in ASCII information.

0 Karma

Flynt
Splunk Employee
Splunk Employee

If I recall correctly it was done in python calling the "last" command using subprocess.

See this article for some basic uses for "last".

http://www.linuxnix.com/2012/10/read-view-utmp-wtmp-btmp-file-linuxunix.html

0 Karma

Flynt
Splunk Employee
Splunk Employee

The issue here is the wtmp sourcetype you have defined in the inputs.conf. Splunk will reject the wtmp sourcetype and consider the files binary. Changing the sourcetype to wtmp_log or wtmplogs will solve the issue and allow indexing of files within this directory.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...