Splunk Dev

Splunk app writing to a location

nb1016
Engager
We found a Splunk app which allows us to take a file and write it to our Splunk server before sending it off to a data store.
Due to issues with this app, I downloaded it, modified it, and re-uploaded it with some slight changes to the codebase. After this change, the new uploaded app does not have permissions to write to the filesystem, and we get this error "Unexpected error: [Errno 30] Read-only file system" when we try and use any of its alerts which write to a file.
This did not happen in the original app, which confuses me, as the logic for the file uploading, and the file destination have not changed.

These are the relevant bits of code which are throwing an error currently. Anyone know why this might not be working?

if not os.path.exists("out"):
os.makedirs("out")

filename= "out/"+sid+".csv"

For context, the only changes were that finaland we are running our instance on Splunk Cloud so do not have direct access to the filesystem to be able to debug why this issue is getting thrown.

Labels (2)
0 Karma
1 Solution

nb1016
Engager

Solved this issue by simply writing to the /tmp directory instead as everyone has read/write permissions there.

View solution in original post

0 Karma

nb1016
Engager

Solved this issue by simply writing to the /tmp directory instead as everyone has read/write permissions there.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...