Problem running Custom Script

[Greg_LeBlanc]

Have created a custom Perl script, added it to commands.conf - it finds the script just fine. The script outputs the correct data, but whenever I run it Splunk gives me these errors:

External search command 'get_asn' returned error code 9. Script output = "String found where operator expected at /services/splunk/bin/runScript.py line 19, near """ (Might be a runaway multi-line "" string starting on line 1) (Missing semicolon on previous line?) String found where operator expected at /services/splunk/bin/runScript.py line 19, near """"" (Missing operator before ""?) Semicolon seems to be missing at /services/splunk/bin/runScript.py line 20. Bareword found where operator expected at /services/splunk/bin/runScript.py line 25, near ""UNIT_TEST_EXTRA_LOGGING" in" (Missing operator before in?) syntax error at /services/splunk/bin/runScript.py line 19, near """ Execution of /services/splunk/bin/runScript.py aborted due to compilation errors. "

I've looked over the runScript.py file, I didn't see any problems with that.

Any suggestions?

Edit: Here's my commands.conf file as requested. This is per the Splunk.com entry on commands.conf

[get_asn]
type = perl
filename = get_asn.pl
streaming = true
retainsevents = true

[jpass]

Try removing the underscore in: [get_asn]

I'm not 100% sure but I just started learning to use custom command with a perl script and this seemed to fix my issue.

[gkanapathy]

I don't know, but I suspect it's a problem running Perl scripts when most search scripts are Python. I assume you have no trouble running, say "rangemap"? I guess it would interesting to see the commands.conf entry (whether you have set the type to perl, and whether you are running distributed search. It may also just be a bug.

[Greg_LeBlanc]

Rangemap works great, I will add my commands.conf entry above. And yes - I am using distributed search over n number of indexes.

[Medavian]

Umm, .py files are python scripts aren't they ?

Not sure if SPLUNK supports perl scripts, but I would change the extension to a .pl in case that is screwing with the script interpreters.

[jpass]

Splunk supports PERL Scripts.