Building for the Splunk Platform

Why am I getting "Cannot find program 'runshellscript'" errors when trying to execute a python script triggered by a saved search?

lquinn
Contributor

I have been running a saved search which triggers a python script for the last few months. I needed to make some changes to the script so I edited it and replaced the version which I kept in splunk/bin/scripts. However since I have replaced the script, it has not been executed when the saved search has run, however the search has run successfully. The following error appears in the _internal logs:

11-03-2014 16:49:36.699 +0000 ERROR SearchScheduler - Error in 'runshellscript' command: Cannot find program 'runshellscript' or script 'runshellscript'., search='runshellscript "myscript.py" "38257" "index=example_search" "index=example_search" "mysavedsearch" "Saved Search [mysavedsearch] always(38257)" "http://localhost.localdomain:8000/app/search/@go?sid=scheduler__admin__search__mysavedsearch_at_1415033340_278" "" "scheduler__admin__search__mysavedsearch_at_1415033340_278" "/opt/splunk/var/run/splunk/dispatch/scheduler__admin__search__gdhtd_at_1415033340_278/results.csv.gz" maxtime="5m"'

runshellscript.py is still in the same place that it always has been - in splunk/etc/apps/search/bin/default. I also made a copy into splunk/etc/apps/search/bin as a I read somewhere that that is where splunk looked for it. This made no difference. Since the script was the only thing that I changed, I tried replacing it with a barebones script that I know has no errors and this still did not work. In fact if I call a script that doesn't even exist, it still come up with the same error. I have also changed all of the permissions so that all the files are read/writeable by anyone. Anybody got any ideas?

0 Karma
1 Solution

lquinn
Contributor

So in the end this problem just fixed itself, I have no idea why, but a few days later the script was being called successfully and no more errors!

View solution in original post

0 Karma

robertlight
Path Finder

I have a feeling this is caused by not having the correct splunk "capability" assigned to the user. It is unclear which "capability" is needed - but I'm having this problem and when I add the role "admin" to my user, it starts working fine.

0 Karma

robertlight
Path Finder

the capability "edit_scripted" is required to use "runshellscript"

not clear if the splunk documenation states this...but via trial and error - it is indeed a fact in v6.2.2

0 Karma

lquinn
Contributor

So in the end this problem just fixed itself, I have no idea why, but a few days later the script was being called successfully and no more errors!

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...