Deployment Architecture

Executing external script in SHC Clustering enviourment - 6.2.2.

rakesh_498115
Motivator

Hi All,

I am using Splunk version 6.2.2 with 4 Search heads and formed a Search Head Cluster enviourment with those 4 servers. I have a scheduled search running on this cluster to call the external shellscript to email the search results "results.gz" content to different customers based on the logic in the shell script.

This script is working fine in a Single Non Clustered Searchhead but when comes to clustered enviourment , I am seeing the following error and the scripts seems to be not working as expected.

02-15-2017 03:04:19.516 +0000 ERROR
script -
sid:scheduler_nobody_eGJ0X3NwaHVyX2FsZXJ0cw_RMD58550cea47a8bcd3a_at_1487127660_19_4EFB41A7-977F-4746-9C8F-5BE724662CDD
command="runshellscript", Script:
/appl1/splunk/etc/apps/xbt_sphur_alerts/bin/scripts/echo.sh
exited with status code: 2

Could you please help what could be the issue here ??

thanks,
Rakesh.

Tags (1)
0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

If you examine the runshellscript.py code there is only one place where it exits with code 2:

script = sys.argv[1]

if not script:
splunk.Intersplunk.generateErrorResults("Empty string is not a valid script name")
exit(2)

do you also see that message in you logs?

I would make sure that the app has been deployed to all members of the SHC.

0 Karma

rakesh_498115
Motivator

No john , I am just seeing the error code 2 but not the msg..

If I call the default echo.sh script it's working fine but when I try to call the another script in echo.sh file it's throwing this error.

It's works fine in single search head environment but here I am having the issue. Am I missing something

0 Karma

koshyk
Super Champion

did you deploy your app containing the script using "deployer"?

0 Karma

rakesh_498115
Motivator

yes koshyk. i have deployed the apps using the deployer only.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...