topic Script input troubleshoot in Getting Data In

Script input troubleshoot

tamduong16 — Tue, 29 Sep 2020 19:14:09 GMT

Hi, I am trying to index from my python script. I followed the steps in this page to setup my data: http://docs.splunk.com/Documentation/Splunk/latest/Data/Getdatafromscriptedinputs#Add_a_scripted_input_in_Splunk_Web

I don't know why I tried the followings without it working:
- Placed the python script in these files ($SPLUNK_HOME/etc/system/bin and $SPLUNK_HOME/etc/apps/search/bin)
- write a stanza in inputs.conf (tried both $SPLUNK_HOME/etc/system/local folder and $SPLUNK_HOME/etc/apps/search/local folder)
- also wrote a stanza for props.conf in $SPLUNK_HOME/etc/system/local folder
- restart the splunkd

I followed steps in the documentation and also tested the scripts in command line. I still don't know what am i missing here. This is my input.conf stanza:
[script://C:\Program Files\Splunk\etc\system\bin]
disabled = 0
host = ABC
index = report
interval = -1
source = reportA
sourcetype = report_json

Thanks for the help!

Re: Script input troubleshoot

jconger — Tue, 24 Apr 2018 16:36:31 GMT

Here is what i would do:

Place your Python file in $SPLUNK_HOME/etc/apps/search/local/bin
Create/edit $SPLUNK_HOME/etc/apps/search/local/inputs

Here are the contents of inputs.conf:

[script://.\bin\myScript.py]
interval = -1 # or some other interval
# any other settings

Re: Script input troubleshoot

tamduong16 — Tue, 24 Apr 2018 16:49:29 GMT

@jconger
I don't have a bin folder in that directory. Do I just create a bin folder?

Re: Script input troubleshoot

tamduong16 — Tue, 24 Apr 2018 17:03:56 GMT

I added a bin folder in that directory but i don't have it working 😞

Re: Script input troubleshoot

jconger — Tue, 24 Apr 2018 17:09:50 GMT

Yes, just create a bin folder

Re: Script input troubleshoot

jconger — Tue, 24 Apr 2018 17:13:47 GMT

An interval of -1 tells Splunk to run the script at start up. Have you restarted?

How are you testing this? Are you running a search on your report index (as specified in your example inputs.conf)?

Also, I'm making assumptions on your Python code. Whatever goes to STDOUT (the screen when run from the command line) should show up in Splunk.

Do you see any errors in your internal index using the following search:

index=_internal sourcetype=splunkd

Re: Script input troubleshoot

tamduong16 — Tue, 29 Sep 2020 19:14:18 GMT

You are right. I could see an error as below:
ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\search\bin\REV_API_viewerreport.py"" python: can't open file 'C:\Program Files\Splunk\etc\apps\search\bin\REV_API_viewerreport.py': [Errno 2] No such file or directory.

I do have my python script in that directory. Why does it state no such file?
I used command line to run the script and I could see the changes in the index. But when I start to put the script in Splunk it doesn't work. Thanks!

Re: Script input troubleshoot

jconger — Tue, 24 Apr 2018 17:51:49 GMT

What does your inputs.conf look like now?

Re: Script input troubleshoot

tamduong16 — Tue, 29 Sep 2020 19:13:12 GMT

@jconger
I found out where the problem is. I have to remove the . infront of .\bin\myscript.py. But I ran into another problem with ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\system\bin\REV_API_viewerreport.py"" ImportError: No module named splunklib.client.
I tried to play the splunklib packages inside bin but it still dispay the same error. How can I fix this error?

Re: Script input troubleshoot

jconger — Tue, 24 Apr 2018 19:06:48 GMT

You will need to put any dependencies in your bin directory too. splunklib.client is in the Splunk Python SDK. You can download it here -> http://dev.splunk.com/python. Copy the splunklib folder into your bin folder.