Why is the script failing with parse interval error when pushed as App from Deployment server?

mallempatisreed — Tue, 29 Sep 2020 18:05:57 GMT

hi Team,

We are using a script to read files at regular intervals of time 900 seconds. It is working fine in our production environment where we have copied the script as an app manually. In our test environment when we pushed the App from Deployment server it is failing with Parse error.

02-20-2018 07:15:30.434 +0100 ERROR ExecProcessor - Can't parse interval "900 #frequency to run the script, in seconds", ignoring script: "/app/splunkforwarder/etc/apps/TA_goep_esbsrv_foldermonitoring_CI/bin/filewatchError.sh"

Am using the below App.

TA_goep_esbsrv_foldermonitoring_CI App with bin and local folders.

local has inputs.conf

inputs.conf
[script://$SPLUNK_HOME/etc/apps/TA_goep_esbsrv_foldermonitoring_CI/bin/filewatchError.sh]
host = SERVERNAME
index = esbsrvtest
interval = 900   #frequency to run the script, in seconds
sourcetype = foldermonitoringError

bin folder has files to monitor and sh script.

 cat filewatchError.sh
#!/bin/bash
file="/app/splunkforwarder/etc/apps/TA_goep_esbsrv_foldermonitoring_CI/bin/error-folders-CI.txt"
#Check the white space and stop before new line
while IFS= read -r var || [[ -n $var ]]
do
        #Check directory if exists
        if [ -d "$var" ]
        then
                #find the count of files on directory posted before 3 min
                number=$(find "$var" -type f | wc -l)

                if [ "$number" -gt 0 ]
                then
                        #echo "$(find "$var" -type f -printf '%TD %Tc filePath=%p timeModified=%TY-%Tm-%Td %TH:%TM\n')"
                        #echo "$(date) $(find "$var" -type f -printf 'filePath=%p timeModified=%TY-%Tm-%Td %TH:%TM\n')"
                        /usr/bin/find "$var" -type f -printf 'filePath=%p timeModified=%TY-%Tm-%Td %TH:%TM\n' | /usr/bin/xargs -I {} echo "$(date) {}"
                fi
        fi
done <"$file"

What can be wrong as it is working when it has been copied manually and it's not working when pushed from the Deployment server.

Thanks,
Sreedhar

Re: Why is the script failing with parse interval error when pushed as App from Deployment server?

yannK — Thu, 22 Feb 2018 01:04:40 GMT

End of line comments are not allowed in .conf files.
see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Howtoeditaconfigurationfile#Insert_a_comment

instead of

 interval = 900   #frequency to run the script, in seconds

put your comment on the next line

 interval = 900   
#frequency to run the script, in seconds

topic Why is the script failing with parse interval error when pushed as App from Deployment server? in Getting Data In

Why is the script failing with parse interval error when pushed as App from Deployment server?

Re: Why is the script failing with parse interval error when pushed as App from Deployment server?