Splunk Dev

How to troubleshoot why my basic custom Python command is not working?

clorne
Communicator

I would like to develop a python custom search command. At this time, my script does nothing but generates errors.

Here is the script monitor.py (located in Splunk/etc/apps/HOME_COM/bin):

import splunk.Intersplunk as si
results = si.getOrganizedResults()
si.outputResults(results)

In Splunk/etc/apps/HOME_COM/local/commands.conf I added

[monitore]
filename = monitore.py
streaming = true
enableheader = true
run_in_preview = true
local = false
retainsevents = true

Then in my app : HOME_COM

 * |head 10|monitore

I systematically get the following error:

External search command 'monitore' returned error code 1.

I found also in Activity->System activity-> Internal Errors and Messages the following error that occurs each time I call the "monitore" command.

10-19-2015 21:41:37.557 +0200 ERROR ExecProcessor - message from "/Applications/Splunk/etc/apps/routemap/bin/launch_app.sh" /bin/sh: /Applications/Splunk/etc/apps/routemap/bin/launch_app.sh: Permission denied

Regards

0 Karma
1 Solution

MuS
Legend

Hi clorne,

For better troubleshooting, take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/AdvancedDev/ModInputsLog to add some error logging features in your script and find the errors either in index=_internal ExecProcessor or splunkd.log.

The other error is not related to your script, it's from the routemap app - but you have the wrong permission on it; probably x bit missing.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi clorne,

For better troubleshooting, take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/AdvancedDev/ModInputsLog to add some error logging features in your script and find the errors either in index=_internal ExecProcessor or splunkd.log.

The other error is not related to your script, it's from the routemap app - but you have the wrong permission on it; probably x bit missing.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...