All Apps and Add-ons

creating a deployment app to push and run a bash script

agentguerry
Path Finder

Is it possible to create a splunk deployment app that i can push out to my forwarders that will run a bash script every minute to gather facts and push them to a log?

I have looked at some of the documentation, and created an app, placed my bash script in the /opt/splunk/etc/deployment-apps/myapp/bin/script.sh

I can see that it gets deployed to my test server, but i see in my splunkd.log that i get

"Incorrect path to script: /opt/splunk/etc/deployment-apps/myapp/bin/script.sh Script must be inside $SPLUNK_HOME/bin/scripts".

my default/inputs.conf file has:

[script://path to the script]
disabled=0
interval=60
sourcetype=splunkd

0 Karma

koshyk
Super Champion

Can you check what have you put as path to the script ? It is quite important to put the exact stanza in your query, so we can see if it is different

The Correct way to put it is (please check this documentation)

[script://$SPLUNK_HOME/etc/apps/<appName>/bin/script.sh]
disabled = false
host = whateverHost
index = yourindex
interval = 60    #frequency to run the script, in seconds
source = my_db
sourcetype = my_db_data
0 Karma

ddrillic
Ultra Champion

A similar issue at Correct Location for Splunk Input Scripts and troubleshooting

Looking at my deployment server and I have a couple with -
$SPLUNK_HOME/etc/deployment-apps/<my app>/bin in which the various .sh exist.

0 Karma

ddrillic
Ultra Champion

And in the spirit of what @koshyk said, we used a relative path in inputs.conf -

 [script://./bin/<script name>]
 interval = 60
 sourcetype = vmstat
 source = vmstat
 index = xxxxxx
 disabled = 0

Like this, these different paths in the deployment server $SPLUNK_HOME/etc/deployment-apps/<my app>/bin and on the forwarder - $SPLUNK_HOME/etc/apps/<my app>/bin don't confuse us.

0 Karma

agentguerry
Path Finder

On my deployment server i have:

/opt/splunk/etc/deployment-apps/metrics
and within that path, folders bin, default, and local

my script is in the bin folder
and my inputs.conf file is in the default folder

The contents of my inputs.conf file is:

[script://$SPLUNK_HOME/etc/deployment-apps/metrics/bin/metrics.sh]
disabled = 0
interval = 60
source = /opt/splunkforwarder/var/log/splunk/metrics.log
sourcetype = splunkd

0 Karma

ddrillic
Ultra Champion

Oh, please change it to [./bin/metrics.sh]

0 Karma

agentguerry
Path Finder

that helped me. changing the path.

Thank you for the assistance.

0 Karma

ddrillic
Ultra Champion

Great news @agentguerry !!!

Please accept the answer or upvote it, or even do both, as I do when I get really excited and cheerful.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...