S.o.S TA Unix - Error nfs-iostat.py - no splunk.bundle

[chrisitanmoleck]

Good Morning,

I installed the S.o.S Add-on on Suse Linux Enterprise.
I activated the ps_sos.sh, lsof_sos.sh, nfs-iostat_sos.py in the inputs.conf of the app.

After a restart of the forwarder, I get following error-message in the logfile:

Traceback (most recent call last):
File "/opt/splunkforwarder/etc/apps/TA-sos/bin/nfs-iostat.py, line 27, in
import splunk.bundle
ImportError: No module named splunk.bundle

I tried to setup the python path via (found in Splunk/Answers)

/opt/splunkforwarder/bin/splunk cmd python /opt/splunkforwarder/etc/apps/TA-sos/bin/nfs-iostat.py

After executing this command I get following error-mesage:

couldn't run "/opt/splunkforwarder/bin/python": No such file or directory

What I have to do?

Thanks for your help.

Best regards,
Christian

[martin_mueller · Accepted solution]

The Universal Forwarder doesn't come with Python out of the box: http://docs.splunk.com/Documentation/Splunk/6.0.3/Forwarding/Introducingtheuniversalforwarder#Script...

[hexx]

@martin_mueller is correct on all accounts. This script has been added to the S.o.S add-on in case you would like to install just that on one of your pooled search-heads instead of the whole app, and still benefit of this scripted input.

[martin_mueller]

The TA is also meant for full Splunk instances such as indexers and search heads, reporting values to the SoS app but without any requirement for local dashboards.

As for that specific script, here's its purpose from the app release notes: "* [SUP-573] A new scripted input is now available to monitor the I/O usage of pooled search-heads on the shared NFS device: nfs-iostat_sos.py"
Search Heads always have a full Splunk Python installation.

[chrisitanmoleck]

Then, I don't understand why these .py file is included in a TA.

[martin_mueller]

You don't have the libraries included in full Splunk installations though. The doc linked says this: "If you have been using calls specific to Splunk's Python libraries, you cannot do so with the universal forwarder, because those libraries exist only in full Splunk Enterprise."

[chrisitanmoleck]

Python 2.6.9 is already installed.