Developing for Splunk Enterprise

scripted input does not produce same results as running script manually

bkwoka
Explorer

I have a python script that queries a mongo database and pulls all the results since the last time the script ran. it then stores the date of the last event it pulled to a text file to reference later. When I run this script manually it works exactly as intended. When it runs through Splunk it never creates the text document that contains the last date pulled and for some reason it only returns the last document when it should return multiple events.

my configuration is as follows:

inputs.conf
[script://$SPLUNK_HOME/etc/apps/xdrip_mongo/bin/entries.py]
disabled = false
interval = 30
source = xdrip
sourcetype = mellitus_entry

props.conf
[mellitus_entry]
SHOULD_LINEMERGE = false

and the relevant portion of python:

try:
    f_lastDate = open('lastDate.txt', 'r')
    s_lastDate = f_lastDate.read()
    try:
        int_lastDate = int(s_lastDate)
    except ValueError:
        int_lastDate = 0
except IOError:
    int_lastDate = 0
    s_lastDate = str(int_lastDate)
f_lastDate = open('lastDate.txt', 'w')

for doc_entry in entries.find({'date': {"$gt": int_lastDate}}):
    print "_id = %s, date = %s, dateString = %s, device = %s," \
          "direction = %s, filtered = %s, noise = %s, rssi = %s," \
          "sgv = %s, type = %s, unfiltered = %s" % \
            (doc_entry['_id'],
                doc_entry['date'],
                doc_entry['dateString'],
                doc_entry['device'],
                doc_entry['direction'],
                doc_entry['filtered'],
                doc_entry['noise'],
                doc_entry['rssi'],
                doc_entry['sgv'],
                doc_entry['type'],
                doc_entry['unfiltered'])

    s_lastDate = str(doc_entry['date'])

f_lastDate.write(s_lastDate)
0 Karma
1 Solution

bkwoka
Explorer

I figured it out. The script is running with system32 as the working directory. I assumed it would be running in the /bin of the app. Once I hardcoded the absolute path it worked.

View solution in original post

0 Karma

micahkemp
Champion

Refer to a previous answers post in regards to testing your script with the same environment that will be used when the script is run for your input.

It's likely that your runtime environment looks different when you're running it manually to test and when it's run by Splunk.

0 Karma

bkwoka
Explorer

I figured it out. The script is running with system32 as the working directory. I assumed it would be running in the /bin of the app. Once I hardcoded the absolute path it worked.

View solution in original post

0 Karma