All Apps and Add-ons

creating a deployment app to push and run a bash script

agentguerry
Path Finder

Is it possible to create a splunk deployment app that i can push out to my forwarders that will run a bash script every minute to gather facts and push them to a log?

I have looked at some of the documentation, and created an app, placed my bash script in the /opt/splunk/etc/deployment-apps/myapp/bin/script.sh

I can see that it gets deployed to my test server, but i see in my splunkd.log that i get

"Incorrect path to script: /opt/splunk/etc/deployment-apps/myapp/bin/script.sh Script must be inside $SPLUNK_HOME/bin/scripts".

my default/inputs.conf file has:

[script://path to the script]
disabled=0
interval=60
sourcetype=splunkd

0 Karma

GDustin
Path Finder
0 Karma

koshyk
Super Champion

Can you check what have you put as path to the script ? It is quite important to put the exact stanza in your query, so we can see if it is different

The Correct way to put it is (please check this documentation)

[script://$SPLUNK_HOME/etc/apps/<appName>/bin/script.sh]
disabled = false
host = whateverHost
index = yourindex
interval = 60    #frequency to run the script, in seconds
source = my_db
sourcetype = my_db_data
0 Karma

ddrillic
Ultra Champion

A similar issue at Correct Location for Splunk Input Scripts and troubleshooting

Looking at my deployment server and I have a couple with -
$SPLUNK_HOME/etc/deployment-apps/<my app>/bin in which the various .sh exist.

0 Karma

ddrillic
Ultra Champion

And in the spirit of what @koshyk said, we used a relative path in inputs.conf -

 [script://./bin/<script name>]
 interval = 60
 sourcetype = vmstat
 source = vmstat
 index = xxxxxx
 disabled = 0

Like this, these different paths in the deployment server $SPLUNK_HOME/etc/deployment-apps/<my app>/bin and on the forwarder - $SPLUNK_HOME/etc/apps/<my app>/bin don't confuse us.

0 Karma

agentguerry
Path Finder

On my deployment server i have:

/opt/splunk/etc/deployment-apps/metrics
and within that path, folders bin, default, and local

my script is in the bin folder
and my inputs.conf file is in the default folder

The contents of my inputs.conf file is:

[script://$SPLUNK_HOME/etc/deployment-apps/metrics/bin/metrics.sh]
disabled = 0
interval = 60
source = /opt/splunkforwarder/var/log/splunk/metrics.log
sourcetype = splunkd

0 Karma

ddrillic
Ultra Champion

Oh, please change it to [./bin/metrics.sh]

0 Karma

agentguerry
Path Finder

that helped me. changing the path.

Thank you for the assistance.

0 Karma

ddrillic
Ultra Champion

Great news @agentguerry !!!

Please accept the answer or upvote it, or even do both, as I do when I get really excited and cheerful.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...