All Apps and Add-ons

Splunk Add-on for *Nix "ignoring alternate expansion" for specified inputs on new server

manderson7
Contributor

I've got the Splunk_TA_nix app installed on all of my *nix servers, and only want to get top, ps and vmstat from certain servers. I copied the Splunk_TA_nix app to a new app, copied over the inputs that I wanted and deployed to that server. I'm not getting those sourcetypes from a search on that server, and a skim of splunkd on that server shows:

08-08-2017 15:30:52.479 -0400 WARN  IConfCache - Stanza has an expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix/bin/ps.sh], ignoring alternate expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix_DHIS/bin/ps.sh] in inputs.conf
08-08-2017 15:30:52.479 -0400 WARN  IConfCache - Stanza has an expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix/bin/top.sh], ignoring alternate expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix_DHIS/bin/top.sh] in inputs.conf
08-08-2017 15:30:52.479 -0400 WARN  IConfCache - Stanza has an expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix/bin/vmstat.sh], ignoring alternate expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix_DHIS/bin/vmstat.sh] in inputs.conf

What am I doing wrong here? Thanks.

sloshburch
Splunk Employee
Splunk Employee

The problem is the scripted inputs are defined with relative paths. So pull path changes when the app name changes. See a complete explanation and walkthrough of workarounds in the post What are best practices for deploying an add-on with slightly different configurations?

0 Karma

napomokoetle
Communicator

In my situation I had the same scripts deployed to .../apps/Splunk_TA_nix_spectrum/bin as were already existing in .../apps/Splunk_TA_nix/bin on the HF agents.
That generated the errors as per your post. I then deleted the scripts in the path .../apps/Splunk_TA_nix/bin and my redeployed and the monitor scripts in my app folder .../apps/Splunk_TA_nix_spectrum/bin started working as expected.

0 Karma

manderson7
Contributor

I told inputs.conf to use the scripts in Splunk_TA_nix instead of Splunk_TA_nix_DHIS, and it stated working. Unsure why, but not arguing.

0 Karma

hardikJsheth
Motivator

You should not copy same contents to multiple apps. Ideally you can just disable unnecessary inputs by making changes to $SPLUNK_HOME/etc/apps/Splunk_TA_nix/local/inputs.conf instead.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...