topic Re: Script placed in SH Pool .../SH_POOL/etc/apps/search/bin/ directory is not found by Splunk. in Deployment Architecture

Script placed in SH Pool .../SH_POOL/etc/apps/search/bin/ directory is not found by Splunk.

the_wolverine — Thu, 11 Apr 2013 19:28:22 GMT

I have a script the location specified above which is the SH Pool. The SH Pool is configured and working in all other aspects. However, the script can not be located by Splunk and I see the following error:

04-11-2013 19:15:27.782 +0000 ERROR script - command="runshellscript", Cannot find script at /opt/splunk/bin/scripts/myscript.sh

As a workaround, I have moved a copy of the script to the local directory on each search head.

Re: Script placed in SH Pool .../SH_POOL/etc/apps/search/bin/ directory is not found by Splunk.

LukeMurphey — Thu, 11 Apr 2013 20:36:58 GMT

If your script is referenced using a path based on $SPLUNK_HOME, then it won't work on search head pooling because the $SPLUNK_HOME variable won't point to the shared storage location. Make the path relative and it should work. See below for an example of a inputs.conf entry:

This won't work on search-head pooling :

[script://$SPLUNK_HOME/etc/apps/someapp/bin/myscript.sh]
disabled = false
interval = 0 0 * * 3

This will work on search-head pooling:

[script://./bin/myscript.sh]
disabled = false
interval = 0 0 * * 3

From what I can tell, your are using runshellscript which is no longer supported by Splunk. There might be a better way to execute your script using supported solutions that work with search-head pooling.

Re: Script placed in SH Pool .../SH_POOL/etc/apps/search/bin/ directory is not found by Splunk.

LukeMurphey — Thu, 11 Apr 2013 20:38:37 GMT

What is the purpose of the script? The solution is a little different based on what the script is intended to do.

Re: Script placed in SH Pool .../SH_POOL/etc/apps/search/bin/ directory is not found by Splunk.

the_wolverine — Fri, 12 Apr 2013 17:41:45 GMT

The script is a simple bash script that is triggered by scheduled search.

Re: Script placed in SH Pool .../SH_POOL/etc/apps/search/bin/ directory is not found by Splunk.

the_wolverine — Fri, 12 Apr 2013 17:42:12 GMT

That was a bad example. I use relative path in my script. The runshellcommand is used by Splunk when a script is triggered via scheduled search.

Re: Script placed in SH Pool .../SH_POOL/etc/apps/search/bin/ directory is not found by Splunk.

LukeMurphey — Mon, 28 Sep 2020 13:43:27 GMT

@the_wolverine: You'll need to use the absolute path to the shared storage location or a relative path. The original question indicated that $SPLUNK_HOME was used and this won't work. The point of the example was to illustrate incorrect versus correct path usage.

Re: Script placed in SH Pool .../SH_POOL/etc/apps/search/bin/ directory is not found by Splunk.

LukeMurphey — Fri, 12 Apr 2013 17:57:36 GMT

Are you using the absolute path to the shared storage location?

Re: Script placed in SH Pool .../SH_POOL/etc/apps/search/bin/ directory is not found by Splunk.

the_wolverine — Fri, 12 Apr 2013 18:58:20 GMT

I'm curious. What other supported solution for what I'm trying do might exist? I'm triggering a script using a scheduled search and inputing the script name in the field provided in Splunk UI for such script.

Re: Script placed in SH Pool .../SH_POOL/etc/apps/search/bin/ directory is not found by Splunk.

the_wolverine — Fri, 12 Apr 2013 19:04:35 GMT

There is no path to input. I'm placing the script in the path I have specified above. Then I'm specifying the name of that script in the field provided by Splunk UI.

Re: Script placed in SH Pool .../SH_POOL/etc/apps/search/bin/ directory is not found by Splunk.

the_wolverine — Fri, 12 Apr 2013 19:10:18 GMT

Turns out the issue was with the location of that script. I moved the script to SH_POOL/etc/apps/search/bin/scripts/ and it is working now.

Re: Script placed in SH Pool .../SH_POOL/etc/apps/search/bin/ directory is not found by Splunk.

LukeMurphey — Fri, 12 Apr 2013 19:28:28 GMT

Ah, I gotcha. So your not using runshellcommand directly, Splunk is using it for you. That makes more sense. That should be supported. Direct use of that command is not (which I incorrectly thought you were doing).

Re: Script placed in SH Pool .../SH_POOL/etc/apps/search/bin/ directory is not found by Splunk.

LukeMurphey — Fri, 12 Apr 2013 19:28:49 GMT

When you use a relative path, does Splunk list the absolute path in the error message? I'm curious as to why Splunk isn't converting that to the path on the shared storage where the script presumably is. Also, what happens if you use an absolute path to the script on the shared storage location?

Re: Script placed in SH Pool .../SH_POOL/etc/apps/search/bin/ directory is not found by Splunk.

LukeMurphey — Fri, 12 Apr 2013 19:44:16 GMT

I wondered if the path was just wrong. That makes sense now. Thanks for posting the solution.