topic Re: Why my inputs.conf doesn't run? in Getting Data In

Why my inputs.conf doesn't run?

sjlin — Mon, 28 Sep 2020 16:09:11 GMT

I have a starter_script.bat in $splunk_home\etc\apps\MyApp\bin, and its content are:
@echo off
python "C:\Program Files\Splunk\etc\apps\MyApp\bin\execute.py" arg1 arg2

and the $splunk_home\etc\apps\MyApp\default\inputs.conf:

[script://.\bin\starter_script.bat]
disabled = false
interval = 10
index = default

after restart inputs.conf, I use the command "splunk.exe cmd btool inputs list" to see if the bat is running, and I can see that:

[script://C:\Program Files\Splunk\etc\apps\MyApp\bin\starter_script.bat]
_rcvbuf = 1572864
disabled = false
evt_dc_name =
evt_dns_name =
evt_resolve_ad_obj = 0
host = WIN-MyHost
index = default
interval = 10

The .bat is not working, but I am sure it can be working when I try it manually.
I am wondering if any configuration I set is wrong?
Any response is appreciated.

Re: Why my inputs.conf doesn't run?

MuS — Mon, 17 Mar 2014 10:28:14 GMT

Hi sjlin,

use this as start script for your input:

$SPLUNK_HOME\bin\splunk cmd python execute.py arg1 arg2

this way all Splunk relevant environment settings are made and the script will be executed as Splunk user.
Or you call/start your execute.py directly and use $SPLUNK_HOME\bin\python as shebang ...
like this:

$SPLUNK_HOME\bin\python execute.py arg1 arg2

hope this helps ...

cheers, MuS

Re: Why my inputs.conf doesn't run?

sjlin — Mon, 17 Mar 2014 11:13:32 GMT

Thanks for your reply.
I modify the bat as:
@echo off
"C:\Program Files\Splunk\bin\python" "C:\Program Files\Splunk\etc\apps\MyApp\bin\execute.py" arg1 arg2

and
@echo off
"C:\Program Files\Splunk\bin\splunk" cmd python "C:\Program Files\Splunk\etc\apps\MyApp\bin\execute.py" arg1 arg2

It seems like the neither of the two ways is working...

Re: Why my inputs.conf doesn't run?

MuS — Mon, 17 Mar 2014 11:22:19 GMT

why are you using a .bat to start a python script? start the python script directly instead

Re: Why my inputs.conf doesn't run?

sjlin — Mon, 28 Sep 2020 16:09:25 GMT

Do you mean modify inputs.conf as below?
[script://$SPLUNK_HOME\bin\python $SPLUNK_HOME\etc\apps\MyApp\bin\execute.py arg1 arg2]
disabled = false
interval = 10
index = default

And I find some error message in splunkd.log in either way:
03-17-2014 19:40:01.181 +0800 ERROR ExecProcessor - Ignoring: ""C:\Program Files\Splunk\bin\python" "C:\Program Files\Splunk\etc\apps\MyApp\bin\execute.py" arg1 arg2"

Re: Why my inputs.conf doesn't run?

MuS — Mon, 17 Mar 2014 11:56:44 GMT

no, you can call your execute.py as input script. place #!$SPLUNK_HOME\bin\python at the first line of execute.py

if it still fails, read this http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptWriting

Re: Why my inputs.conf doesn't run?

sjlin — Tue, 18 Mar 2014 02:44:54 GMT

I change inputs.conf as:
[script://.\bin\execute.py arg1 arg2]
disabled = false
interval = 10
index = default

and add #!$SPLUNK_HOME\bin\python to the first line of execute.py

It is still not working...
I have read http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptWriting, but I can't get something useful...

Re: Why my inputs.conf doesn't run?

MuS — Tue, 18 Mar 2014 06:55:28 GMT

since your on windows your path must look like this:

[script://.\bin\execute.py arg1 arg2]