topic Re: Is it Possible to Configure a cronjob with Scripted Input in Getting Data In

Is it Possible to Configure a cronjob with Scripted Input

JoshuaJJ — Tue, 11 Mar 2025 19:44:17 GMT

Hello,

I have a bash script that basically creates a cronjob. Not sure if this is allowed or not but I am able to execute it just fine when logged into the splunkfwd account on the UF. However, when ExecProc tries to execute it gives me a permission denied. (The below app is deployed via a Deployment Server)

Sample Script (something simple, trying to get it to work first before i build in my if/then statements)

#!/bin/bash

# List the current user's crontab and save output to /tmp/cron_out
echo "* * * * * testing_this_out" | crontab - > /tmp/cron_out 2>&1

inputs.conf

[script://./bin/install_cron.sh]
disabled = false
interval = 10
sourcetype = cron_upgrader
index = splunk_upgrade

App Structure

/opt/splunkforwarder/etc/apps/<app_name>/

...........bin > install_cron.sh

...........local > inputs.conf

Not sure, but I am pretty sure Splunk restricts what can be executed since if I manually execute the script, it works fine.

Re: Is it Possible to Configure a cronjob with Scripted Input

livehybrid — Tue, 11 Mar 2025 22:22:40 GMT

Hi @JoshuaJJ

Make sure that the file has execute chmod settings so that it can be executed without prepending with "bash" (for example)

chmod +x <yourSHFile)

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: Is it Possible to Configure a cronjob with Scripted Input

JoshuaJJ — Wed, 12 Mar 2025 13:12:44 GMT

Good morning, thanks for your reply! File already has execute

Re: Is it Possible to Configure a cronjob with Scripted Input

livehybrid — Wed, 12 Mar 2025 14:06:57 GMT

Thats odd @JoshuaJJ - Please can you post the logs that ExecProcessor spits out so I can try and replicate this?

Thanks

Re: Is it Possible to Configure a cronjob with Scripted Input

PickleRick — Wed, 12 Mar 2025 20:33:08 GMT

If something "should work" but gives permission denied, the first culprit to check is SELinux 🙂