Archive

creating a deployment app to push and run a bash script

Explorer

Is it possible to create a splunk deployment app that i can push out to my forwarders that will run a bash script every minute to gather facts and push them to a log?

I have looked at some of the documentation, and created an app, placed my bash script in the /opt/splunk/etc/deployment-apps/myapp/bin/script.sh

I can see that it gets deployed to my test server, but i see in my splunkd.log that i get

"Incorrect path to script: /opt/splunk/etc/deployment-apps/myapp/bin/script.sh Script must be inside $SPLUNK_HOME/bin/scripts".

my default/inputs.conf file has:

[script://path to the script]
disabled=0
interval=60
sourcetype=splunkd

0 Karma

Path Finder
0 Karma

Super Champion

Can you check what have you put as path to the script ? It is quite important to put the exact stanza in your query, so we can see if it is different

The Correct way to put it is (please check this documentation)

[script://$SPLUNK_HOME/etc/apps/<appName>/bin/script.sh]
disabled = false
host = whateverHost
index = yourindex
interval = 60    #frequency to run the script, in seconds
source = my_db
sourcetype = my_db_data
0 Karma

Ultra Champion

A similar issue at Correct Location for Splunk Input Scripts and troubleshooting

Looking at my deployment server and I have a couple with -
$SPLUNK_HOME/etc/deployment-apps/<my app>/bin in which the various .sh exist.

0 Karma

Ultra Champion

And in the spirit of what @koshyk said, we used a relative path in inputs.conf -

 [script://./bin/<script name>]
 interval = 60
 sourcetype = vmstat
 source = vmstat
 index = xxxxxx
 disabled = 0

Like this, these different paths in the deployment server $SPLUNK_HOME/etc/deployment-apps/<my app>/bin and on the forwarder - $SPLUNK_HOME/etc/apps/<my app>/bin don't confuse us.

0 Karma

Explorer

On my deployment server i have:

/opt/splunk/etc/deployment-apps/metrics
and within that path, folders bin, default, and local

my script is in the bin folder
and my inputs.conf file is in the default folder

The contents of my inputs.conf file is:

[script://$SPLUNK_HOME/etc/deployment-apps/metrics/bin/metrics.sh]
disabled = 0
interval = 60
source = /opt/splunkforwarder/var/log/splunk/metrics.log
sourcetype = splunkd

0 Karma

Ultra Champion

Oh, please change it to [./bin/metrics.sh]

0 Karma

Explorer

that helped me. changing the path.

Thank you for the assistance.

0 Karma

Ultra Champion

Great news @agentguerry !!!

Please accept the answer or upvote it, or even do both, as I do when I get really excited and cheerful.

0 Karma