All Apps and Add-ons

Splunk Add-on for *Nix "ignoring alternate expansion" for specified inputs on new server

manderson7
Contributor

I've got the Splunk_TA_nix app installed on all of my *nix servers, and only want to get top, ps and vmstat from certain servers. I copied the Splunk_TA_nix app to a new app, copied over the inputs that I wanted and deployed to that server. I'm not getting those sourcetypes from a search on that server, and a skim of splunkd on that server shows:

08-08-2017 15:30:52.479 -0400 WARN  IConfCache - Stanza has an expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix/bin/ps.sh], ignoring alternate expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix_DHIS/bin/ps.sh] in inputs.conf
08-08-2017 15:30:52.479 -0400 WARN  IConfCache - Stanza has an expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix/bin/top.sh], ignoring alternate expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix_DHIS/bin/top.sh] in inputs.conf
08-08-2017 15:30:52.479 -0400 WARN  IConfCache - Stanza has an expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix/bin/vmstat.sh], ignoring alternate expansion [script:///opt/splunk/etc/apps/Splunk_TA_nix_DHIS/bin/vmstat.sh] in inputs.conf

What am I doing wrong here? Thanks.

sloshburch
Splunk Employee
Splunk Employee

The problem is the scripted inputs are defined with relative paths. So pull path changes when the app name changes. See a complete explanation and walkthrough of workarounds in the post What are best practices for deploying an add-on with slightly different configurations?

0 Karma

napomokoetle
Communicator

In my situation I had the same scripts deployed to .../apps/Splunk_TA_nix_spectrum/bin as were already existing in .../apps/Splunk_TA_nix/bin on the HF agents.
That generated the errors as per your post. I then deleted the scripts in the path .../apps/Splunk_TA_nix/bin and my redeployed and the monitor scripts in my app folder .../apps/Splunk_TA_nix_spectrum/bin started working as expected.

0 Karma

manderson7
Contributor

I told inputs.conf to use the scripts in Splunk_TA_nix instead of Splunk_TA_nix_DHIS, and it stated working. Unsure why, but not arguing.

0 Karma

hardikJsheth
Motivator

You should not copy same contents to multiple apps. Ideally you can just disable unnecessary inputs by making changes to $SPLUNK_HOME/etc/apps/Splunk_TA_nix/local/inputs.conf instead.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...