File/Directory Information Input App: Seeing error in the log (server has Python 2.7.5).

[dpark1113]

Hi,

Just installed the app on a universal forwarder and getting this error in the log. Any idea what the issue is? Is there any configuration I need to edit other than inputs.conf? Thanks.

Server has Python 2.7.5 and I created symlink: splunkforwarder/bin/python2.7 -> /usr/bin/python

file_meta_data_modular_input.log:

2020-05-27 13:04:35,867 ERROR Execution failed
Traceback (most recent call last):
  File "/home/opc/splunk/splunkforwarder/etc/apps/file_meta_data/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 1095, in execute
    self.do_run(in_stream, log_exception_and_continue=True)
  File "/home/opc/splunk/splunkforwarder/etc/apps/file_meta_data/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 976, in do_run
    self.run(stanza, cleaned_params, input_config)
  File "/home/opc/splunk/splunkforwarder/etc/apps/file_meta_data/bin/file_meta_data.py", line 621, in run
    file_filter=file_filter)
TypeError: get_file_data() got an unexpected keyword argument 'file_filter'

inputs.conf:

[file_meta_data://vendor_data]
interval          = 5m
file_hash_limit   = 500MB
file_path         = /home/vendor_files/
recurse           = 0
only_if_changed   = 0
include_file_hash = 0
disabled          = 0

[dpark1113]

UPDATE:

I looked at the code file_meta_data.py, and removed the file_filter=file_filter in these lines. That seems working.

if recurse:
results, new_latest_time = self.get_files_data(file_path, logger=self.logger,
latest_time=latest_time,
must_be_later_than=must_be_later_than,
file_hash_limit=file_hash_limit,
depth_limit=depth_limit)
else:
result, new_latest_time = self.get_file_data(file_path, logger=self.logger,
latest_time=latest_time,
must_be_later_than=must_be_later_than,
file_hash_limit=file_hash_limit)