Splunk Dev

How to troubleshoot why my basic custom Python command is not working?

clorne
Communicator

I would like to develop a python custom search command. At this time, my script does nothing but generates errors.

Here is the script monitor.py (located in Splunk/etc/apps/HOME_COM/bin):

import splunk.Intersplunk as si
results = si.getOrganizedResults()
si.outputResults(results)

In Splunk/etc/apps/HOME_COM/local/commands.conf I added

[monitore]
filename = monitore.py
streaming = true
enableheader = true
run_in_preview = true
local = false
retainsevents = true

Then in my app : HOME_COM

 * |head 10|monitore

I systematically get the following error:

External search command 'monitore' returned error code 1.

I found also in Activity->System activity-> Internal Errors and Messages the following error that occurs each time I call the "monitore" command.

10-19-2015 21:41:37.557 +0200 ERROR ExecProcessor - message from "/Applications/Splunk/etc/apps/routemap/bin/launch_app.sh" /bin/sh: /Applications/Splunk/etc/apps/routemap/bin/launch_app.sh: Permission denied

Regards

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi clorne,

For better troubleshooting, take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/AdvancedDev/ModInputsLog to add some error logging features in your script and find the errors either in index=_internal ExecProcessor or splunkd.log.

The other error is not related to your script, it's from the routemap app - but you have the wrong permission on it; probably x bit missing.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi clorne,

For better troubleshooting, take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/AdvancedDev/ModInputsLog to add some error logging features in your script and find the errors either in index=_internal ExecProcessor or splunkd.log.

The other error is not related to your script, it's from the routemap app - but you have the wrong permission on it; probably x bit missing.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...