Scripted Input: Python->Bat- File->JAR File

[jeffreynmoss]

1) I have a JAR file that produces data I wish to index.
2) I have a BAT file that calls that JAR file,
3) I have a py file that calls the BAT file.

I am able to execute all 3 components from the Windows cmdline separately and receive the expected results on stdout.

I have configured a Script Data Input that calls the py file every 60 seconds
[script://$SPLUNK_HOME/etc/apps/my-app/bin/my-script.py]
disabled = 0
index = my_index
interval = 60
sourcetype = my_ds

I have raised LOg Level on ExecProcessor to DEBUG

All I can get from the logs is an entry every 60 seconds like:
05-09-2018 11:46:27.483 -0400 DEBUG ExecProcessor - cmd='python "C:\Program Files\Splunk\etc\apps\my-app\bin\my-script.py"' Not added to run queue

If I replace the call to the BAT file in the py file with a print command - that output does come into the index, but as soon as I replace it with a call to the bat file, it again fails in obscurity.

Here is an excerpt of the py file after the import statements:
script_dirpath = os.path.dirname(os.path.join(os.getcwd(), file))
script_filepath = os.path.join(script_dirpath, 'my-script.bat')
print subprocess.call(script_filepath)

I have also tried configuring the input to call the BAT file directly, but get the same result.

Can anybody point to an example where this method works, or to a way to increase logging level on nother component so I can see why it is failing?

[jeffreynmoss · Accepted solution]

Found that I had tested the JAR file under my Windows user name, but when run from Splunk, it is run under SYSTEM user. Further, I had code that used the USER name to construct a path to configuration data, which when run under Splunk did not exist for the SYSTEM user.

So changing the code to look for configuration data relative to the current working directory solved the problem.