All Apps and Add-ons

Error "get_file_data() got an unexpected keyword argument 'file_filter'"

santosh_sshanbh
Path Finder

I have configured one input using the File-Meta Data input to monitor a log file. But I am getting below error in the file_meta_data_modular_input.log file

2018-10-25 08:03:20,519 ERROR Execution failed
Traceback (most recent call last):
File "D:\Program Files\Splunk\etc\apps\file_meta_data\bin\modular_input.zip\modular_input\modular_input_base_class.py", line 1083, in execute
self.do_run(in_stream, log_exception_and_continue=True)
File "D:\Program Files\Splunk\etc\apps\file_meta_data\bin\modular_input.zip\modular_input\modular_input_base_class.py", line 964, in do_run
self.run(stanza, cleaned_params, input_config)
File "D:\Program Files\Splunk\etc\apps\file_meta_data\bin\file_meta_data.py", line 619, in run
file_filter=file_filter)
TypeError: get_file_data() got an unexpected keyword argument 'file_filter'

Any idea? I have installed the app on the SH.

0 Karma

LukeMurphey
Champion

I tested this and the app works. Could you ensure that:

  1. You have version 1.4 installed?
  2. $SPLUNK_HOME/etc/apps/splunk-file-info/src/bin/file_meta_data.py contains the following line:

            WildcardField("file_filter", "File Name Filter",
                         "A wildcard for which files will be included",
                         none_allowed=True, empty_allowed=True)
            ]
    
0 Karma

santosh_sshanbh
Path Finder

I have the PY file at below path on my system

$SPLUNK_HOME\etc\apps\file_meta_data\bin

App name is file_meta_data and not splunk-file-info. Did I downloaded and installed wrong app version?

0 Karma

LukeMurphey
Champion

This looks like a bug to me. It might be a regression from the most recent update (1.4). I'm investigating this and will get an update posted ASAP. I'm looking into the error in this ticket: https://lukemurphey.net/issues/2301

Update:
I don't believe this is a bug after all. I am unable to reproduce the issue and a survey of the code makes me think it ought to work. Furthermore, all unit tests pass.

I suspect not all of the files got copied in the install.

0 Karma

santosh_sshanbh
Path Finder

I am also getting below error

2020-02-11 12:37:06,907 ERROR Execution failed
Traceback (most recent call last):
File "F:\Program Files\Splunk\etc\apps\file_meta_data\bin\modular_input.zip\modular_input\modular_input_base_class.py", line 1095, in execute
self.do_run(in_stream, log_exception_and_continue=True)
File "F:\Program Files\Splunk\etc\apps\file_meta_data\bin\modular_input.zip\modular_input\modular_input_base_class.py", line 976, in do_run
self.run(stanza, cleaned_params, input_config)
File "F:\Program Files\Splunk\etc\apps\file_meta_data\bin\file_meta_data.py", line 621, in run
file_filter=file_filter)
TypeError: get_file_data() got an unexpected keyword argument 'file_filter'

My inputs.conf is as below

[file_meta_data://Monitor Folder1]
file_hash_limit = 1GB
file_path = F:\StartingPoint\Splunk
include_file_hash = 0
index = main
interval = 5m
only_if_changed = 0
recurse = 0
file_filter = *

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...