Getting Data In

Problem: scripted inputs stop running in certain time ?

sieutruc
Contributor

Hello,

I have several scripted input written in python. At the beginning, it run well but after about 10 minutes, it stopped running, and in the splunkd.log i just see an error as below:

09-25-2012 10:54:09.821 +0200 INFO  ExecProcessor - Ran script: "C:\Program Files\Splunk\etc\apps\Splunk_TA_windows\bin\memory.bat", took -3304.2 seconds to run, 617 bytes read
09-25-2012 10:54:47.977 +0200 WARN  DispatchCommand - Modtime 'Tue Sep 25 11:44:45 2012' for 'C:\Program Files\Splunk\var\run\splunk\dispatch\1348566284.10\status.csv' is 2998.0 seconds in the future; please check for clock skew
09-25-2012 11:58:56.175 +0200 INFO  WinEventLogChannel - getEvents: Unable to read Windows Event Logs 'System'; rec_id='0'; t_bytes_read='0'; bytes_needed='0'; buf_size='131071'; err_msg(38)='Reached the end of the file.';
09-25-2012 12:00:18.177 +0200 INFO  WinEventLogChannel - getEvents: Unable to read Windows Event Logs 'System'; rec_id='0'; t_bytes_read='0'; bytes_needed='0'; buf_size='131071'; err_msg(38)='Reached the end of the file.';

I don't know why it likes that. It's strange that the error is not concerning about scripted input file . Any suggestion for solving that problem ?

Tags (1)
0 Karma
1 Solution

Drainy
Champion

I would suggest that nothing above relates to your script or is in fact a problem.

Do a search for index=_internal error *py* to see if you can locate any actual error.
How does your script terminate?
Also, do you have any logging inside your script? If not, I would suggest importing logging and generate your own logs to gain visibility to what your script is up to.

P.S. The bits above are just talking about a batch file executing, monitor reaching the end of some event logs, a time issue on a CSV file..

View solution in original post

Drainy
Champion

I would suggest that nothing above relates to your script or is in fact a problem.

Do a search for index=_internal error *py* to see if you can locate any actual error.
How does your script terminate?
Also, do you have any logging inside your script? If not, I would suggest importing logging and generate your own logs to gain visibility to what your script is up to.

P.S. The bits above are just talking about a batch file executing, monitor reaching the end of some event logs, a time issue on a CSV file..

sieutruc
Contributor

Thanks for your suggestion for logging. In fact, my problem is about time difference between the indexer and the machine that i used to view Splunk web. After i made a time balance between both of them, it seems to run well and the scipted input doesn't still get stuck.
But i think Splunk should fairly deal with this issue in case of viewing web remotely.

0 Karma

MHibbin
Influencer

To add some references to this...

The following is the official docs on logging:
http://docs.python.org/howto/logging.html

And this has various solutions in a cookbook format:
http://docs.python.org/howto/logging-cookbook.html

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...