topic Re: Splunk errors generated alongside successful data import with input script in Getting Data In

Splunk errors generated alongside successful data import with input script

ayuri — Fri, 23 Oct 2020 19:13:37 GMT

Hi,

I'm getting the following error message from the splunk python code in admin.py (the trace is below in bold) every time my input script gets called. Despite the recurrent error the input script gets all the data imported successfully. I've checked inputs.conf many times and tried different parameters according to the spec to see if it made any difference but no. There are no errors in the script itself. There is no impact on the app functionality but this error pollutes the log which is the issue I'm trying to solve. Any clues what could trigger this?

Thanks

File "/opt/splunk/lib/python3.7/site-packages/splunk/admin.py", line 137, in init

mode = ((len(sys.argv) > 1) and sys.argv[1] in ARGS_LIST) and sys.argv[1] or usage()

File "/opt/splunk/lib/python3.7/site-packages/splunk/admin.py", line 16, in usage

raise UsageException("Usage: %s [%s]. (Got: %s)" % (sys.argv[0], str.join(str(" | "), ARGS_LIST), sys.argv))

splunk.admin.UsageException: Usage: /opt/splunk/etc/apps/myapp/bin/myscript.py [setup | execute | persistent]. (Got: ['/opt/splunk/etc/apps/myapp/bin/myscript.py'])

Re: Splunk errors generated alongside successful data import with input script

kbehl — Sun, 25 Oct 2020 19:27:52 GMT

From the first look of it:

splunk.admin.UsageException: Usage: /opt/splunk/etc/apps/myapp/bin/myscript.py [setup | execute | persistent]. (Got: ['/opt/splunk/etc/apps/myapp/bin/myscript.py']

The usage of execution is throwing exception because script is not being passed one of 3 arguments: setup, execute or persistent.

Try passing one as the argument and see if the error goes away.

Re: Splunk errors generated alongside successful data import with input script

ayuri — Mon, 26 Oct 2020 18:18:27 GMT

Yes, but it looks to me that the error message is internal to Splunk (from splunk/sdmin.py). The AppInspect report is clean. My script doesn't need/support any such command flags [setup | execute | persistent]. Or is it required to support these flags? I couldn't find it in the documentation..

Re: Splunk errors generated alongside successful data import with input script

ayuri — Tue, 27 Oct 2020 15:26:46 GMT

Where can I find the spec for these command flags (setup | execute | persistent)? It looks like they have to be supported to avoid this error message in the log. I cannot find it in the documentation. Thanks

Re: Splunk errors generated alongside successful data import with input script

ayuri — Tue, 27 Oct 2020 16:31:26 GMT

If passing one of these flags, the error is gone but the session key cannot be retrieved anymore so can't get token and other parameters necessary for getting the data

Re: Splunk errors generated alongside successful data import with input script

isoutamo — Tue, 27 Oct 2020 16:33:16 GMT

You could test it with command
splunk cmd python <path to your input>
It executes it as it has called as input.
r. Ismo

Re: Splunk errors generated alongside successful data import with input script

ayuri — Tue, 27 Oct 2020 19:41:21 GMT

That was helpful, saves me a restart, thanks.

Where can I read about the "[setup | execute | persistent]" flags? I was not able to find it in the documentation.

When I provide one of those - the error is gone but I no longer can get the session key with sys.stdin.readline().strip()

Re: Splunk errors generated alongside successful data import with input script

isoutamo — Tue, 27 Oct 2020 21:12:17 GMT

If there haven’t any other instructions then you must read code to get hints. Based on those parameters, I first try with setup and after that with execute. But best option is read docs and/or code.
r. Ismo

Re: Splunk errors generated alongside successful data import with input script

ayuri — Wed, 28 Oct 2020 18:57:29 GMT

Alright, that was a harmless (caught) exception in some legacy code that produced the SDK error.. would be a breeze to find it if running locally (no license though)