ERROR FrameworkUtils - Incorrect path to script, no data is received

[halr9000]

No NetApp data is shown on dashboards, and I receive the following data in splunkd log:

02-20-2013 14:38:03.476 -0500 ERROR FrameworkUtils - Incorrect path to script: D:\Program Files\Splunk/etc/apps/SplunkAppforNetApp/bin/SNap.py.  Script must be located inside $SPLUNK_HOME\bin\scripts.
02-20-2013 14:38:03.476 -0500 ERROR ExecProcessor - Ignoring: ""D:\Program Files\Splunk/etc/apps/SplunkAppforNetApp/bin/SNap.py""

Splunk server platform is Windows

[halr9000 · Accepted solution]

This is a Splunk-on-Windows thing that will be made easier and more clear at release. Today, inputs.conf is very picky with the forward/reverse slashes. Hopefully this will be more transparent in future versions of Splunk, but for now, we have to change the slashes.

For example, in the app under default/inputs.conf:

[script://$SPLUNK_HOME/etc/apps/SplunkAppforNetApp/bin/SNap.py]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

Everything should work fine if we change the slashes like so:

[script://$SPLUNK_HOME\etc\apps\SplunkAppforNetApp\bin\SNap.py]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

Note that the first two slashes remain forward.

This is an odd case that will be resolved more gracefully, but for now, the best solution is to change default/inputs.conf so that the last stanza looks like the above. Note that you can fix this by adding a stanza to local/inputs.conf, but as the slashes are different, a local config will not match, so you would end up with two stanzas (one broken, one functional) where you only want one.