Deployment Architecture

How to handle splunkbase apps with "[script::...]: stanzas in "inputs.conf" when deploying from Cluster Master in "master-apps" to "slave-apps"?

Esteemed Legend

How do you handle the fact that apps like Splunk_TA_nix and Splunk_TA_windows have relative paths like [script://./bin/] that will not resolve correctly when deployed by the Cluster Master via master-apps to slave-apps on the indexer and results in failure to run and errors like this:

04-18-2020 18:07:11.694 -0400 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_nix/bin/" /bin/sh: /opt/splunk/etc/apps/Splunk_TA_nix/bin/ No such file or directory

What compounds it is that we also send these same apps to our UFs where they work fine as-is. Obviously the problem is that the relative path resolution code in splunkd is hard-coded to use $SPLUNK_HOME/etc/apps and with cluster master the apps are in $SPLUNK_HOME/etc/slave-apps/. It looks like Splunk may never fix it to be smarter, so we have to accommodate both ways. We are looking for the most portable and lightweight method. I can think of (and have tried) at least 3 ways but I don't really like any of them. What do you do? Is there any way to use the same inputs.conf file for Clustered Indexers and other nodes?

Labels (3)


I have the wrapper script have some knowledge of the possibility it may be in a different place. For example:

# masters push out apps to etc/slave-apps on indexers


if [[ ! -e ${APPBASEDIR} ]]; then
    log "Not deployed to ${APPBASEDIR}; checking for indexer deployment"
    if [[ -e ${APPBASEDIRSLAVE} ]]; then
        log "Updating basedir"
        log "Unable to find deployment."
        exit 1
0 Karma


Hi @woodcock,

Since all these inputs are disabled by default, in any case, you will need to create an inputs.conf file to enable them. I would edit the script path while creating inputs in the app (i.e. org_all_indexers_inputs ) that I create for input settings for indexers.

If this reply helps you an upvote is appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out >> Kudos to all the ...