Have created a custom Perl script, added it to commands.conf - it finds the script just fine. The script outputs the correct data, but whenever I run it Splunk gives me these errors:
External search command 'get_asn' returned error code 9. Script output = "String found where operator expected at /services/splunk/bin/runScript.py line 19, near """ (Might be a runaway multi-line "" string starting on line 1) (Missing semicolon on previous line?) String found where operator expected at /services/splunk/bin/runScript.py line 19, near """"" (Missing operator before ""?) Semicolon seems to be missing at /services/splunk/bin/runScript.py line 20. Bareword found where operator expected at /services/splunk/bin/runScript.py line 25, near ""UNIT_TEST_EXTRA_LOGGING" in" (Missing operator before in?) syntax error at /services/splunk/bin/runScript.py line 19, near """ Execution of /services/splunk/bin/runScript.py aborted due to compilation errors. "
I've looked over the runScript.py file, I didn't see any problems with that.
Edit: Here's my commands.conf file as requested. This is per the Splunk.com entry on commands.conf
[get_asn] type = perl filename = get_asn.pl streaming = true retainsevents = true
Umm, .py files are python scripts aren't they ?
Not sure if SPLUNK supports perl scripts, but I would change the extension to a .pl in case that is screwing with the script interpreters.
I don't know, but I suspect it's a problem running Perl scripts when most search scripts are Python. I assume you have no trouble running, say "rangemap"? I guess it would interesting to see the commands.conf entry (whether you have set the
perl, and whether you are running distributed search. It may also just be a bug.
Try removing the underscore in: [get_asn]
I'm not 100% sure but I just started learning to use custom command with a perl script and this seemed to fix my issue.