All Apps and Add-ons

S.o.S TA Unix - Error nfs-iostat.py - no splunk.bundle

chrisitanmoleck
Path Finder

Good Morning,

I installed the S.o.S Add-on on Suse Linux Enterprise.
I activated the ps_sos.sh, lsof_sos.sh, nfs-iostat_sos.py in the inputs.conf of the app.

After a restart of the forwarder, I get following error-message in the logfile:

Traceback (most recent call last):
File "/opt/splunkforwarder/etc/apps/TA-sos/bin/nfs-iostat.py, line 27, in
import splunk.bundle
ImportError: No module named splunk.bundle

I tried to setup the python path via (found in Splunk/Answers)

/opt/splunkforwarder/bin/splunk cmd python /opt/splunkforwarder/etc/apps/TA-sos/bin/nfs-iostat.py

After executing this command I get following error-mesage:

couldn't run "/opt/splunkforwarder/bin/python": No such file or directory

What I have to do?

Thanks for your help.

Best regards,
Christian

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

martin_mueller
SplunkTrust
SplunkTrust

hexx
Splunk Employee
Splunk Employee

@martin_mueller is correct on all accounts. This script has been added to the S.o.S add-on in case you would like to install just that on one of your pooled search-heads instead of the whole app, and still benefit of this scripted input.

martin_mueller
SplunkTrust
SplunkTrust

The TA is also meant for full Splunk instances such as indexers and search heads, reporting values to the SoS app but without any requirement for local dashboards.

As for that specific script, here's its purpose from the app release notes: "* [SUP-573] A new scripted input is now available to monitor the I/O usage of pooled search-heads on the shared NFS device: nfs-iostat_sos.py"
Search Heads always have a full Splunk Python installation.

chrisitanmoleck
Path Finder

Then, I don't understand why these .py file is included in a TA.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You don't have the libraries included in full Splunk installations though. The doc linked says this: "If you have been using calls specific to Splunk's Python libraries, you cannot do so with the universal forwarder, because those libraries exist only in full Splunk Enterprise."

0 Karma

chrisitanmoleck
Path Finder

Python 2.6.9 is already installed.

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...