creating a deployment app to push and run a bash script

[agentguerry]

Is it possible to create a splunk deployment app that i can push out to my forwarders that will run a bash script every minute to gather facts and push them to a log?

I have looked at some of the documentation, and created an app, placed my bash script in the /opt/splunk/etc/deployment-apps/myapp/bin/script.sh

I can see that it gets deployed to my test server, but i see in my splunkd.log that i get

"Incorrect path to script: /opt/splunk/etc/deployment-apps/myapp/bin/script.sh Script must be inside $SPLUNK_HOME/bin/scripts".

my default/inputs.conf file has:

[script://path to the script]
disabled=0
interval=60
sourcetype=splunkd

[GDustin]

this has a working example I've used a few times;
https://splunkbase.splunk.com/app/2975/

https://github.com/hire-vladimir/SA-syslog_collection/blob/master/default/inputs.conf
https://github.com/hire-vladimir/SA-syslog_collection/tree/master/bin

[koshyk]

Can you check what have you put as path to the script ? It is quite important to put the exact stanza in your query, so we can see if it is different

The Correct way to put it is (please check this documentation)

[script://$SPLUNK_HOME/etc/apps/<appName>/bin/script.sh]
disabled = false
host = whateverHost
index = yourindex
interval = 60    #frequency to run the script, in seconds
source = my_db
sourcetype = my_db_data

[ddrillic]

A similar issue at Correct Location for Splunk Input Scripts and troubleshooting

Looking at my deployment server and I have a couple with -
$SPLUNK_HOME/etc/deployment-apps/<my app>/bin in which the various .sh exist.

[ddrillic]

And in the spirit of what @koshyk said, we used a relative path in inputs.conf -

 [script://./bin/<script name>]
 interval = 60
 sourcetype = vmstat
 source = vmstat
 index = xxxxxx
 disabled = 0

Like this, these different paths in the deployment server $SPLUNK_HOME/etc/deployment-apps/<my app>/bin and on the forwarder - $SPLUNK_HOME/etc/apps/<my app>/bin don't confuse us.

[agentguerry]

On my deployment server i have:

/opt/splunk/etc/deployment-apps/metrics
and within that path, folders bin, default, and local

my script is in the bin folder
and my inputs.conf file is in the default folder

The contents of my inputs.conf file is:

[script://$SPLUNK_HOME/etc/deployment-apps/metrics/bin/metrics.sh]
disabled = 0
interval = 60
source = /opt/splunkforwarder/var/log/splunk/metrics.log
sourcetype = splunkd

[ddrillic]

Oh, please change it to [./bin/metrics.sh]

[agentguerry]

that helped me. changing the path.

Thank you for the assistance.

[ddrillic]

Great news @agentguerry !!!

Please accept the answer or upvote it, or even do both, as I do when I get really excited and cheerful.