Getting Data In

Problem running Custom Script

Greg_LeBlanc
Path Finder

Have created a custom Perl script, added it to commands.conf - it finds the script just fine. The script outputs the correct data, but whenever I run it Splunk gives me these errors:

External search command 'get_asn' returned error code 9. Script output = "String found where operator expected at /services/splunk/bin/runScript.py line 19, near """ (Might be a runaway multi-line "" string starting on line 1) (Missing semicolon on previous line?) String found where operator expected at /services/splunk/bin/runScript.py line 19, near """"" (Missing operator before ""?) Semicolon seems to be missing at /services/splunk/bin/runScript.py line 20. Bareword found where operator expected at /services/splunk/bin/runScript.py line 25, near ""UNIT_TEST_EXTRA_LOGGING" in" (Missing operator before in?) syntax error at /services/splunk/bin/runScript.py line 19, near """ Execution of /services/splunk/bin/runScript.py aborted due to compilation errors. "

I've looked over the runScript.py file, I didn't see any problems with that.

Any suggestions?

Edit: Here's my commands.conf file as requested. This is per the Splunk.com entry on commands.conf

[get_asn]
type = perl
filename = get_asn.pl
streaming = true
retainsevents = true
0 Karma

jpass
Contributor

Try removing the underscore in: [get_asn]

I'm not 100% sure but I just started learning to use custom command with a perl script and this seemed to fix my issue.

gkanapathy
Splunk Employee
Splunk Employee

I don't know, but I suspect it's a problem running Perl scripts when most search scripts are Python. I assume you have no trouble running, say "rangemap"? I guess it would interesting to see the commands.conf entry (whether you have set the type to perl, and whether you are running distributed search. It may also just be a bug.

0 Karma

Greg_LeBlanc
Path Finder

Rangemap works great, I will add my commands.conf entry above. And yes - I am using distributed search over n number of indexes.

0 Karma

Medavian
Explorer

Umm, .py files are python scripts aren't they ?

Not sure if SPLUNK supports perl scripts, but I would change the extension to a .pl in case that is screwing with the script interpreters.

0 Karma

jpass
Contributor

Splunk supports PERL Scripts.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...