Deployment Architecture

Distributing scripts using deployment server

meenuvn
Explorer

Hi Splunkers,
Need help with a deployment server concept. Referred splunk docs and few similiar answers, still i'm missing something.

Scenario : I have few scripted inputs and the related input.conf which need to be distributed to a set of UFs in the environment.
Using deployment server, I created an app and then kept the script and input.conf so as to be send down to the clients.
App got distributed and is placed in etc/apps/ folder.
But for the scripted input to work, Splunk expects it to be in $SPLUNK_HOME\bin\scripts folder.

How will I handle this?

Tags (1)
0 Karma
1 Solution

pradeepkumarg
Influencer

Scripts can exist inside the apps folder etc/apps/your_app_name/bin/scripts.
You just have to make sure you call the script form your inputs as $SPLUNK_HOME$/etc/apps/your_app_name/bin/scripts/your_script

View solution in original post

0 Karma

hardikJsheth
Motivator

You can keep script in $SPLUNK_HOME/etc/apps/your_app/bin/ folder. The entry in the inputs.conf should be same as before.
i.e
[script://./bin/Server.py]
disabled = false
interval = 0

Splunk first look for script in the bin folder of the app, then bin folder of the search app and finally under $SPLUNK_HOME/bin/scripts/

0 Karma

meenuvn
Explorer

Thanks for the quick reply gpradeepkumarreddy & hardikJsheth.
So I'm now retrying like this
1. KEpt the script under Scripts/bin/scripts folder.
2. Added input.conf file under Scripts/local folder.

Splunk log in the client machine shows this error.
07-14-2016 00:36:47.562 -0400 ERROR FrameworkUtils - Incorrect path to script: C:\Program Files\SplunkUniversalForwarder\Scripted_Inputs\bin\scripts\Invoke_ErrorDCN.bat. Script must be located inside $SPLUNK_HOME\bin\scripts.
07-14-2016 00:36:47.562 -0400 ERROR ExecProcessor - Ignoring: ""C:\Program Files\SplunkUniversalForwarder\Scripted_Inputs\bin\scripts\Invoke_ErrorDCN.bat""

0 Karma

agentguerry
Path Finder

I have this same issue. what was the fix?

0 Karma

meenuvn
Explorer

Never mind..There was a small mistake..Corrected it and got it working. Thanks much.

0 Karma

pradeepkumarg
Influencer

Scripts can exist inside the apps folder etc/apps/your_app_name/bin/scripts.
You just have to make sure you call the script form your inputs as $SPLUNK_HOME$/etc/apps/your_app_name/bin/scripts/your_script

0 Karma
Get Updates on the Splunk Community!

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...