I have 6 scripted inputs that use the same script, but with different arguments and I'm noticing that it's mixing the events. This seems to happen when the previous script instance finishes after the next has already started. When this happens, I'll see the first event come in with two timestamps (its own and the next) and the next event will have no time stamp at all :-(
I'm using the same source and sourcetype for the 6 script stanzas in inputs.conf. How can I make sure that Splunk keeps is able to distinguish between executions when parsing the events?
↧