topic Re: Scripted inputs fails on pooled search heads in Getting Data In

Scripted inputs fails on pooled search heads

richnavis — Mon, 28 Sep 2020 12:33:20 GMT

I am trying to implement the Cisco IPS App on pooled search heads, but the scripted inputs are failing with the following error: Incorrect path to script: \\Server01\prod\SplunkSharedConfig\etc\apps\Splunk_CiscoIPS\bin\get_ips_feed.py. Script must be in a bin subdirectory in $SPLUNK_HOME.

I've tested the path and it is correct. Anyone have any thoughts?

Re: Scripted inputs fails on pooled search heads

Damien_Dallimor — Mon, 28 Sep 2020 12:33:36 GMT

It looks as if you have placed your input script in your Search Head pools shared storage path hence the error saying that the script must live within $SPLUNK_HOME , //Server01/prod/SplunkSharedConfig is not your $SPLUNK_HOME

You will need to place the script where Splunk is installed ie: $SPLUNK_HOME/etc/apps/Splunk_CiscoIPS/bin/get_ips_feed.py

Re: Scripted inputs fails on pooled search heads

richnavis — Fri, 05 Oct 2012 21:04:03 GMT

Makes sense.. but apps in searchhead pools aren't really shared if they are installed locally..

Re: Scripted inputs fails on pooled search heads

Damien_Dallimor — Mon, 28 Sep 2020 12:34:49 GMT

You still have the apps shared via shared storage , but what you are doing in a distributed setup is splitting out the various components of the app.In this case you are splitting out the data collection components(get_ips_feed.py), which could possibly live on a Splunk forwarder or indexer, from the data viewing and searching components(views, alerts, saved searches,eventtypes, lookups & various other knowledge objects) which can live on your search head pools shared storage path.