topic Re: File Meta Data on Universal Forwarder in All Apps and Add-ons

File Meta Data on Universal Forwarder

Venkat_16 — Wed, 07 Oct 2015 09:02:06 GMT

I am trying to get file changes and metadata information for certain directories.
Can this app File/Directory Information Input be used in Universal Forwarder or does it need heavy forwarder/Enterprise Splunk?

Re: File Meta Data on Universal Forwarder

Venkat_16 — Tue, 29 Sep 2020 07:31:31 GMT

I see the below error in splunkd.log of Universal Forwarder..

ERROR ModularInputs - Unable to initialize modular input "file_meta_data" defined inside the app "file_meta_data": Introspecting scheme=file_meta_data: script running failed (exited with code 1)

My understanding is that, Splunk Universal Forwarder does not have python on its own.
I have python in OS, how do I leverage and acheive this?

Re: File Meta Data on Universal Forwarder

LukeMurphey — Wed, 07 Oct 2015 17:59:19 GMT

The File/Directory Information Input app does use Python and thus does need a Heavy Forwarder.

Update:
I'm looking into supporting this in a later release. See http://lukemurphey.net/issues/1068 for progress updates.

Update [2]:
As of version 1.3, Universal Forwarders are supported provided the host has Python installed.

Re: File Meta Data on Universal Forwarder

Venkat_16 — Fri, 09 Oct 2015 11:07:11 GMT

Agreed.
Is there any option to leverage the python installed in OS. Any workaround?

Re: File Meta Data on Universal Forwarder

LukeMurphey — Tue, 29 Sep 2020 07:30:23 GMT

I haven't tried using system Python to run modular inputs before. I think it may be possible with a small change to the modular input class. Currently, it uses make_splunkhome_path from splunk.appserver.mrsparkle.lib.util which won't be available on system Python. I could make that optional though.

I'm willing to try.

Re: File Meta Data on Universal Forwarder

Venkat_16 — Sun, 18 Oct 2015 08:17:15 GMT

Thanks Luke.

Also, another request is - will it be possible to use cron schedule in the interval field instead of specifying (10m,2h, etc.)?
Does that work already in this app (or in your website monitoring app etc) or it cannot be implemented at all?

Re: File Meta Data on Universal Forwarder

LukeMurphey — Wed, 28 Oct 2015 20:37:37 GMT

It isn't possible now but I'm looking into (http://lukemurphey.net/issues/1095)

Re: File Meta Data on Universal Forwarder

sumgadde — Tue, 29 Sep 2020 22:06:23 GMT

I am getting same error : ERROR ModularInputs - Unable to initialize modular input "file_meta_data" defined inside the app "ab_filemetadata_xx_inputs": Introspecting scheme=file_meta_data: script running failed (exited with code 1).
Python is Running on UF.

inputs.conf

[file_meta_data://Test]
depth_limit = 0
file_hash_limit = 500MB
file_path = /home/gaddes/test.txt
include_file_hash = 0
index = main
interval = 2m
only_if_changed = 1
recurse = 1
disabled = 0
Is there any pointer to resolve this issue ?

Re: File Meta Data on Universal Forwarder

sumgadde — Tue, 29 Sep 2020 22:06:25 GMT

inputs.conf

Add your comment...

Re: File Meta Data on Universal Forwarder

LukeMurphey — Wed, 21 Nov 2018 17:32:57 GMT

Make sure to use the most recent version of the app. There was an issue I recently fixed that prevented the app from working on Universal Forwarders.

Re: File Meta Data on Universal Forwarder

sumgadde — Tue, 29 Sep 2020 22:06:51 GMT

I am using version 1.3 , I assume this version supports UF on which Python is installed. Is there any other pointer ? Should I need to use later version of the App ? If Yes , which Files do I need to update like file_meta_data.py ?
Thanks for Support ...

Re: File Meta Data on Universal Forwarder

LukeMurphey — Tue, 04 Dec 2018 07:10:49 GMT

This is fixed in version 1.4.2.