topic Re: Error when running CLI remotely in Security

Error when running CLI remotely

sieutruc — Wed, 24 Oct 2012 12:54:11 GMT

hello,

When i run CLI remotely to indexer as:

splunk edit exec "c:\Program Files\Splunk\etc\system\bin\memory.bat" -interval 50 -uri https:\\192.168.64.4:8089

I got error saying: "in handle 'script': cannot edit input "c:\Program Files\Splunk\etc\system\bin\memory.bat", no input exist with that name"

But i have configured inputs.conf in indexer as below:

inputs.conf

  [script://$SPLUNK_HOME\etc\system\bin\memory.bat]
    interval = 80
    index = default
    disabled = 0

How can i solve that ?

Another is when i change script's interval, is it triggered right away or waiting for the end of first time of new interval ?

Re: Error when running CLI remotely

Yorokobi — Wed, 24 Oct 2012 15:22:34 GMT

Given that the output you're seeing has the backslashes removed, my best guess is that you'll need to use double back slashes in the path, probably on the CLI rather than in inputs.conf.

Eg: "C:\\Program Files\\Splunk\\etc\\system\\bin\\memory.bat"

Alternatively, use forward slashes.

Re: Error when running CLI remotely

sieutruc — Wed, 24 Oct 2012 17:57:14 GMT

Thanks, but i did but it gives the same error , have you ever done it yet ?

Re: Error when running CLI remotely

bmacias84 — Thu, 25 Oct 2012 00:08:32 GMT

So is your CLI from Linux to Windows, Linux to Linux, or Windows to Linux? Guessing it Linux to Windows.

Windows will interperate '/' same as '\'. Try replacing with the forward slash. Else I look into it some more, let me know.

Re: Error when running CLI remotely

sieutruc — Thu, 25 Oct 2012 09:21:23 GMT

i tried all possible separators /, //, \,\\ , They didn't work. I run CLI from Windows to Windows for testing.

Re: Error when running CLI remotely

Ayn — Thu, 25 Oct 2012 09:27:20 GMT

Not very familiar with editing this stuff from the CLI, but it might be possible that Splunk is matching on the literal $SPLUNK_HOME string, not what it happens to expand to. Did you try using $SPLUNK_HOME in your command?

Re: Error when running CLI remotely

sieutruc — Thu, 25 Oct 2012 11:27:01 GMT

$SPLUNK_HOME is just defined global variable, so substituting it into that command doesn't get better.

Why the set of CLI of Splunk is so limited. It is possible to use Splunk web to active/deactive scripted input whenever need (this isn't documented in any document i believe), as well as changing interval, sourcetype... Maybe the document of this set of CLI doesn't completely be done.

Re: Error when running CLI remotely

bmacias84 — Mon, 28 Sep 2020 12:41:40 GMT

@sieutruc, Ok I think I figured this one out. I've tested this on Splunk 4.3.3 with Linux to Windows and vice versa. Apparrently if you use single or double quotes ( ' or ") around the source in add or edit within exec the CLI bombs out remotely and locally. And you add recieve the following error even though the path is legit.



#ERROR producing commands

splunk add exec "C:/Program Files/SplunkUniversalForwarder/etc/system/bin/test.bat" -interval 50

OR

splunk add exec "$SPLUNK_HOME/etc/system/bin/test.bat" -interval 50

OR

splunk add exec '$SPLUNK_HOME\etc\system\bin\test.bat' -interval 50

OR

splunk add exec "C:\Program Files\SplunkUniversalForwarder\etc\system\bin\test.bat" -interval 50

OR

splunk edit exec '$SPLUNK_HOME\etc\system\bin\test.bat' -interval 80



#ERRORS in splunkd.log

ERROR FrameworkUtils - Incorrect path to script: C:\$SPLUNK_HOME\etc\system\bin\test.bat.  Script must be in a bin subdirectory in $SPLUNK_HOME.

OR 

ERROR FrameworkUtils - Incorrect path to script: C:\Program Files\SplunkUniversalForwarder\etc\system\bin\test.bat.  Script must be in a bin subdirectory in $SPLUNK_HOME.

Working CLI Commands



#WORKING STRINGS

splunk add exec $SPLUNK_HOME\etc\system\bin\test2.bat -interval 60 -uri https://xxxxxx.xxx.167:8089

Configuration updated: '$SPLUNK_HOME\etc\system\bin\test2.bat' has been added for execution.

OR

splunk edit exec $SPLUNK_HOME\etc\system\bin\test2.bat -interval 80 -uri https://xxx.xxx.xxx.167:8089

Configuration updated for '$SPLUNK_HOME\etc\system\bin\test2.bat'.

This seems like a bug to me. If you cant quote a parameter how do you handle spaces?

Hope this helps.

Re: Error when running CLI remotely

sieutruc — Thu, 25 Oct 2012 23:44:57 GMT

i don't know , but i executed:
splunk edit exec "c:\Program Files\Splunk\etc\system\bin\memory.bat" -interval 50 -uri https:\\192.168.64.4:8089

from window 7 to windows 2003, it run smoothly .

But i run your successful command:

splunk add exec $SPLUNK_HOME\etc\system\bin\test2.bat -interval 60 -uri https://xxxxxx.xxx.167:8089

i got an error:10-26-2012 01:37:43.196 +0200 ERROR AdminHandler:Exec - The file "C:\Program Files\Splunk\bin\scripts\/opt/splunketcsystembintets.bat" does not exist. (from Opensuse to windows 2003)

it's so weird,how Splunk handle parameter on linux ?

Re: Error when running CLI remotely

bmacias84 — Fri, 26 Oct 2012 00:29:23 GMT

Not sure. I am using REDHAT and 2k8 Server Core.

You could try passing the Windows Program Files short path.
C:\PROGRA~1\splunk\etc\system\bin\yourbat.bat .Or within a sh script set your $SPLUNK_HOME temporarily to C:\Program Files\Splunk\.

You might need to open a case with support at this point. Sorry I couldnt be of more help.