topic Re: creating a deployment app to push and run a bash script in All Apps and Add-ons

creating a deployment app to push and run a bash script

agentguerry — Thu, 16 May 2019 19:21:58 GMT

Is it possible to create a splunk deployment app that i can push out to my forwarders that will run a bash script every minute to gather facts and push them to a log?

I have looked at some of the documentation, and created an app, placed my bash script in the /opt/splunk/etc/deployment-apps/myapp/bin/script.sh

I can see that it gets deployed to my test server, but i see in my splunkd.log that i get

"Incorrect path to script: /opt/splunk/etc/deployment-apps/myapp/bin/script.sh Script must be inside $SPLUNK_HOME/bin/scripts".

my default/inputs.conf file has:

[script://path to the script]
disabled=0
interval=60
sourcetype=splunkd

Re: creating a deployment app to push and run a bash script

ddrillic — Thu, 16 May 2019 19:56:25 GMT

Looking at my deployment server and I have a couple with -
$SPLUNK_HOME/etc/deployment-apps/<my app>/bin in which the various .sh exist.

Re: creating a deployment app to push and run a bash script

koshyk — Thu, 16 May 2019 20:37:54 GMT

Can you check what have you put as path to the script ? It is quite important to put the exact stanza in your query, so we can see if it is different

The Correct way to put it is (please check this documentation)

[script://$SPLUNK_HOME/etc/apps/<appName>/bin/script.sh]
disabled = false
host = whateverHost
index = yourindex
interval = 60    #frequency to run the script, in seconds
source = my_db
sourcetype = my_db_data

Re: creating a deployment app to push and run a bash script

ddrillic — Fri, 17 May 2019 00:45:05 GMT

And in the spirit of what @koshyk said, we used a relative path in inputs.conf -

 [script://./bin/<script name>]
 interval = 60
 sourcetype = vmstat
 source = vmstat
 index = xxxxxx
 disabled = 0

Like this, these different paths in the deployment server $SPLUNK_HOME/etc/deployment-apps/<my app>/bin and on the forwarder - $SPLUNK_HOME/etc/apps/<my app>/bin don't confuse us.

Re: creating a deployment app to push and run a bash script

agentguerry — Fri, 17 May 2019 02:14:37 GMT

On my deployment server i have:

/opt/splunk/etc/deployment-apps/metrics
and within that path, folders bin, default, and local

my script is in the bin folder
and my inputs.conf file is in the default folder

The contents of my inputs.conf file is:

[script://$SPLUNK_HOME/etc/deployment-apps/metrics/bin/metrics.sh]
disabled = 0
interval = 60
source = /opt/splunkforwarder/var/log/splunk/metrics.log
sourcetype = splunkd

Re: creating a deployment app to push and run a bash script

ddrillic — Fri, 17 May 2019 11:21:28 GMT

Oh, please change it to [./bin/metrics.sh]

Re: creating a deployment app to push and run a bash script

GDustin — Fri, 17 May 2019 11:32:01 GMT

this has a working example I've used a few times;
https://splunkbase.splunk.com/app/2975/

https://github.com/hire-vladimir/SA-syslog_collection/blob/master/default/inputs.conf
https://github.com/hire-vladimir/SA-syslog_collection/tree/master/bin

Re: creating a deployment app to push and run a bash script

agentguerry — Sat, 18 May 2019 02:23:23 GMT

that helped me. changing the path.

Thank you for the assistance.

Re: creating a deployment app to push and run a bash script

ddrillic — Mon, 20 May 2019 01:20:01 GMT

Great news @agentguerry !!!

Please accept the answer or upvote it, or even do both, as I do when I get really excited and cheerful.