I would like to develop a python custom search command. At this time, my script does nothing but generates errors.
Here is the script monitor.py (located in Splunk/etc/apps/HOME_COM/bin):
import splunk.Intersplunk as si
results = si.getOrganizedResults()
In Splunk/etc/apps/HOME_COM/local/commands.conf I added
filename = monitore.py
streaming = true
enableheader = true
run_in_preview = true
local = false
retainsevents = true
Then in my app : HOME_COM
* |head 10|monitore
I systematically get the following error:
External search command 'monitore' returned error code 1.
I found also in Activity->System activity-> Internal Errors and Messages the following error that occurs each time I call the "monitore" command.
10-19-2015 21:41:37.557 +0200 ERROR ExecProcessor - message from "/Applications/Splunk/etc/apps/routemap/bin/launch_app.sh" /bin/sh: /Applications/Splunk/etc/apps/routemap/bin/launch_app.sh: Permission denied
For better troubleshooting, take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/AdvancedDev/ModInputsLog to add some error logging features in your script and find the errors either in index=_internal ExecProcessor or splunkd.log.
The other error is not related to your script, it's from the routemap app - but you have the wrong permission on it; probably x bit missing.
Hope this helps ...
View solution in original post