When you want to capture the entire output of a script as a single event, the trick is to specify an impossible value for LINE_BREAKER. Let's write a shell script to output the different parts of uname with nice field names.
You can find the following script at ImplementingSplunkExtendingExamples/bin/uname.sh:
#!/bin/sh date "+%Y-%m-%d %H:%M:%S" echo hardware="$(uname -m)" echo node="$(uname -n)" echo proc="$(uname -p)" echo os_release="$(uname -r)" echo os_name="$(uname -s)" echo os_version="$(uname -v)" This script produces output like the following code: 2012-10-30 19:28:05 hardware="x86_64" node="mymachine.local" proc="i386" os_release="12.2.0" os_name="Darwin" os_version="Darwin Kernel Version ...
