Deployment Architecture

How to handle splunkbase apps with "[script::...]: stanzas in "inputs.conf" when deploying from Cluster Master in "master-apps" to "slave-apps"?

Esteemed Legend

How do you handle the fact that apps like Splunk_TA_nix and Splunk_TA_windows have relative paths like [script://./bin/] that will not resolve correctly when deployed by the Cluster Master via master-apps to slave-apps on the indexer and results in failure to run and errors like this:

04-18-2020 18:07:11.694 -0400 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_nix/bin/" /bin/sh: /opt/splunk/etc/apps/Splunk_TA_nix/bin/ No such file or directory

What compounds it is that we also send these same apps to our UFs where they work fine as-is. Obviously the problem is that the relative path resolution code in splunkd is hard-coded to use $SPLUNK_HOME/etc/apps and with cluster master the apps are in $SPLUNK_HOME/etc/slave-apps/. It looks like Splunk may never fix it to be smarter, so we have to accommodate both ways. We are looking for the most portable and lightweight method. I can think of (and have tried) at least 3 ways but I don't really like any of them. What do you do? Is there any way to use the same inputs.conf file for Clustered Indexers and other nodes?

Labels (3)
0 Karma


I have the wrapper script have some knowledge of the possibility it may be in a different place. For example:

# masters push out apps to etc/slave-apps on indexers


if [[ ! -e ${APPBASEDIR} ]]; then
    log "Not deployed to ${APPBASEDIR}; checking for indexer deployment"
    if [[ -e ${APPBASEDIRSLAVE} ]]; then
        log "Updating basedir"
        log "Unable to find deployment."
        exit 1
0 Karma


Hi @woodcock,

Since all these inputs are disabled by default, in any case, you will need to create an inputs.conf file to enable them. I would edit the script path while creating inputs in the app (i.e. org_all_indexers_inputs ) that I create for input settings for indexers.

If this reply helps you an upvote is appreciated.
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...