Why does scripted input not get executed?

pbnl — Thu, 11 Aug 2022 14:37:12 GMT

hello all,

i have an app developed on my linux splunk sandbox and it is working fine.
after copying it to the deployment server and deploy it to a UF running on linux, it's not running at all.
the inputs.conf is:

[script://$SPLUNK_HOME/etc/apps/PBNL_getTVlogs/bin/getTVlogs.sh] disabled = false interval = 0 14 * * * index = tvlogs sourcetype = TVlogs [monitor://$SPLUNK_HOME/etc/apps/PBNL_getTVlogs/logs/TVlogs.csv] disabled = false index = tvlogs sourcetype = TVlogs

so what's wrong here?

any help is welcome 🙂

Re: scripted input does not get executed

richgalloway — Thu, 11 Aug 2022 12:53:38 GMT

Any errors in the UF's logs?

Re: scripted input does not get executed

pbnl — Thu, 11 Aug 2022 13:01:04 GMT

no. the only thing i see in the UF's log is, that the app is installed.
all files and folders are created. the monitor is created too:

splunk@srv141:~$ splunk list monitor Monitored Directories: $SPLUNK_HOME/var/log/splunk some other directories Monitored Files: $SPLUNK_HOME/etc/apps/PBNL_getTVlogs/logs/TVlogs.csv some other files

Re: Why does scripted input not get executed?

pbnl — Fri, 12 Aug 2022 08:57:39 GMT

so nobody else any idea why?

to bring in some more details:
the splunk landscape is build out of 4 servers.
1st is Cluster Master, KV Store, License Master, Search Head
2nd and 3rd are Indexer
4th is Deployment Server

the index tvlogs is defined on the cluster master with a whole bunch of other indexes

etc/master-apps/_cluster/local/indexes.conf [tvlogs] repFactor = auto maxHotSpanSecs = 86400 homePath = $SPLUNK_DB/tvlogs/db frozenTimePeriodInSecs = 15552000 thawedPath = $SPLUNK_DB/tvlogs/thaweddb coldPath = $SPLUNK_DB/tvlogs/colddb

and it's deployed to the indexer cluster

splunk@indexer1:[/opt/splunk]: ll var/lib/splunk/tvlogs/* var/lib/splunk/tvlogs/colddb: total 8 drwx------ 2 splunk splunk 4096 Jul 22 14:20 ./ drwx------ 6 splunk splunk 4096 Jul 22 14:20 ../ var/lib/splunk/tvlogs/datamodel_summary: total 8 drwx------ 2 splunk splunk 4096 Jul 22 14:20 ./ drwx------ 6 splunk splunk 4096 Jul 22 14:20 ../ var/lib/splunk/tvlogs/db: total 16 drwx------ 2 splunk splunk 4096 Aug 10 09:17 ./ drwx------ 6 splunk splunk 4096 Jul 22 14:20 ../ -rw------- 1 splunk splunk 169 Aug 10 09:17 .bucketManifest -rw------- 1 splunk splunk 10 Jul 22 14:22 CreationTime

the other files are located on the UF where the script should run

splunk@srv141:~/etc/apps/PBNL_getTVlogs$ ll * bin: total 20 drwxr-xr-x 2 splunk splunk 4096 Aug 11 14:50 ./ drwxr-xr-x 7 splunk splunk 4096 Aug 11 13:34 ../ -rwxrw-r-- 1 splunk splunk 573 Aug 11 14:50 getTVlogs.sh* -rwxrw-r-- 1 splunk splunk 687 Aug 11 13:34 json2csv* default: total 16 drwxr-xr-x 3 splunk splunk 4096 Aug 11 13:34 ./ drwxr-xr-x 7 splunk splunk 4096 Aug 11 13:34 ../ -rw-r--r-- 1 splunk splunk 181 Aug 11 13:34 app.conf drwxr-xr-x 3 splunk splunk 4096 Aug 11 13:34 data/ local: total 20 drwxr-xr-x 2 splunk splunk 4096 Aug 11 13:34 ./ drwxr-xr-x 7 splunk splunk 4096 Aug 11 13:34 ../ -rw-r--r-- 1 splunk splunk 55 Aug 11 13:34 app.conf -rw-rw-r-- 1 splunk splunk 258 Aug 11 13:34 inputs.conf -rw-rw-r-- 1 splunk splunk 388 Aug 11 13:34 props.conf logs: total 16 drwxr-xr-x 2 splunk splunk 4096 Aug 11 14:49 ./ drwxr-xr-x 7 splunk splunk 4096 Aug 11 13:34 ../ metadata: total 16 drwxr-xr-x 2 splunk splunk 4096 Aug 11 13:34 ./ drwxr-xr-x 7 splunk splunk 4096 Aug 11 13:34 ../ -rw-r--r-- 1 splunk splunk 403 Aug 11 13:34 default.meta -rw-r--r-- 1 splunk splunk 187 Aug 11 13:34 local.meta

do i need to change something here?

topic Re: scripted input does not get executed in All Apps and Add-ons

Why does scripted input not get executed?

Re: scripted input does not get executed

Re: scripted input does not get executed

Re: Why does scripted input not get executed?