All Apps and Add-ons

ERROR FrameworkUtils - Incorrect path to script, no data is received

halr9000
Motivator

No NetApp data is shown on dashboards, and I receive the following data in splunkd log:

02-20-2013 14:38:03.476 -0500 ERROR FrameworkUtils - Incorrect path to script: D:\Program Files\Splunk/etc/apps/SplunkAppforNetApp/bin/SNap.py.  Script must be located inside $SPLUNK_HOME\bin\scripts.
02-20-2013 14:38:03.476 -0500 ERROR ExecProcessor - Ignoring: ""D:\Program Files\Splunk/etc/apps/SplunkAppforNetApp/bin/SNap.py""

Splunk server platform is Windows

0 Karma
1 Solution

halr9000
Motivator

This is a Splunk-on-Windows thing that will be made easier and more clear at release. Today, inputs.conf is very picky with the forward/reverse slashes. Hopefully this will be more transparent in future versions of Splunk, but for now, we have to change the slashes.

For example, in the app under default/inputs.conf:

[script://$SPLUNK_HOME/etc/apps/SplunkAppforNetApp/bin/SNap.py]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

Everything should work fine if we change the slashes like so:

[script://$SPLUNK_HOME\etc\apps\SplunkAppforNetApp\bin\SNap.py]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

Note that the first two slashes remain forward.

This is an odd case that will be resolved more gracefully, but for now, the best solution is to change default/inputs.conf so that the last stanza looks like the above. Note that you can fix this by adding a stanza to local/inputs.conf, but as the slashes are different, a local config will not match, so you would end up with two stanzas (one broken, one functional) where you only want one.

View solution in original post

halr9000
Motivator

This is a Splunk-on-Windows thing that will be made easier and more clear at release. Today, inputs.conf is very picky with the forward/reverse slashes. Hopefully this will be more transparent in future versions of Splunk, but for now, we have to change the slashes.

For example, in the app under default/inputs.conf:

[script://$SPLUNK_HOME/etc/apps/SplunkAppforNetApp/bin/SNap.py]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

Everything should work fine if we change the slashes like so:

[script://$SPLUNK_HOME\etc\apps\SplunkAppforNetApp\bin\SNap.py]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

Note that the first two slashes remain forward.

This is an odd case that will be resolved more gracefully, but for now, the best solution is to change default/inputs.conf so that the last stanza looks like the above. Note that you can fix this by adding a stanza to local/inputs.conf, but as the slashes are different, a local config will not match, so you would end up with two stanzas (one broken, one functional) where you only want one.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!