scripted input does not produce same results as running script manually

bkwoka — Tue, 29 Sep 2020 17:27:50 GMT

I have a python script that queries a mongo database and pulls all the results since the last time the script ran. it then stores the date of the last event it pulled to a text file to reference later. When I run this script manually it works exactly as intended. When it runs through Splunk it never creates the text document that contains the last date pulled and for some reason it only returns the last document when it should return multiple events.

my configuration is as follows:

inputs.conf
[script://$SPLUNK_HOME/etc/apps/xdrip_mongo/bin/entries.py]
disabled = false
interval = 30
source = xdrip
sourcetype = mellitus_entry

props.conf
[mellitus_entry]
SHOULD_LINEMERGE = false

and the relevant portion of python:

try:
    f_lastDate = open('lastDate.txt', 'r')
    s_lastDate = f_lastDate.read()
    try:
        int_lastDate = int(s_lastDate)
    except ValueError:
        int_lastDate = 0
except IOError:
    int_lastDate = 0
    s_lastDate = str(int_lastDate)
f_lastDate = open('lastDate.txt', 'w')

for doc_entry in entries.find({'date': {"$gt": int_lastDate}}):
    print "_id = %s, date = %s, dateString = %s, device = %s," \
          "direction = %s, filtered = %s, noise = %s, rssi = %s," \
          "sgv = %s, type = %s, unfiltered = %s" % \
            (doc_entry['_id'],
                doc_entry['date'],
                doc_entry['dateString'],
                doc_entry['device'],
                doc_entry['direction'],
                doc_entry['filtered'],
                doc_entry['noise'],
                doc_entry['rssi'],
                doc_entry['sgv'],
                doc_entry['type'],
                doc_entry['unfiltered'])

    s_lastDate = str(doc_entry['date'])

f_lastDate.write(s_lastDate)

Re: scripted input does not produce same results as running script manually

bkwoka — Sun, 31 Dec 2017 16:00:24 GMT

I figured it out. The script is running with system32 as the working directory. I assumed it would be running in the /bin of the app. Once I hardcoded the absolute path it worked.

Re: scripted input does not produce same results as running script manually

micahkemp — Sun, 31 Dec 2017 17:28:30 GMT

Refer to a previous answers post in regards to testing your script with the same environment that will be used when the script is run for your input.

It's likely that your runtime environment looks different when you're running it manually to test and when it's run by Splunk.

topic Re: scripted input does not produce same results as running script manually in Splunk Dev

scripted input does not produce same results as running script manually

Re: scripted input does not produce same results as running script manually

Re: scripted input does not produce same results as running script manually