Splunk ExecProcessor can't find .bat script

Choi_Hyun — Thu, 06 Jul 2023 15:25:36 GMT

Hello,

I have a simple .bat file that just performs a "dir" command to list everything in a folder.

I have set the input.conf to the following:

[script://.\bin\ListDir.bat] disabled = 0 ## Run Every Ten Seconds interval = 10 sourcetype = Script:ListDir index = main

I have placed my ListDir.bat in the application's \bin\ folder.
When I run the command: splunk cmd ListDir.bat, splunk runs the bat files no problem, displaying all the files I want Splunk to ingest.

However, looking at my Splunkd logs, I see that ExecProcessor lists the exact location where the bat file exists and reads "The system cannot find the file specified."

ERROR ExecProcessor [11384 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_Burn_Folder\bin\ListDir.bat"" The system cannot find the file specified.

I looked at the file permissions and I gave everyone access to this bat file.

Any help is appreciated.

Re: Splunk ExecProcessor can't find .bat script

Choi_Hyun — Wed, 12 Jul 2023 12:14:31 GMT

After few days of work, I figured out that the bat file literally could not find the file. Depending on who is running the bat file (SYSTEM in this case) it changed the environment variable and the folder did not exist.

topic Re: Splunk ExecProcessor can't find .bat script in Getting Data In

Splunk ExecProcessor can't find .bat script

Re: Splunk ExecProcessor can't find .bat script