Getting Data In

Scripted Input: Cannot open file from /myapp/local

vincenteous
Communicator

Hello all,

I have a perl script which is located in /myapp/bin and a configuration file in /myapp/local. I have added a script stanza inside inputs.conf and the script seems to be successfully invoked except for one thing, the script displays an error on splunkd.log that tells my custom configuration file cannot be opened. I have tried using an absolute path to that file and the result is still the same. Can anyone tell me where did I go wrong?

Thanks in advance.

Tags (3)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi vincenteous,

did you place this in /myapp/.. or in $SPLUNK_HOME/etc/apps/myapp/..
Have a look at the docs about scripted inputs where you also get some hints where to put config files.
Another point to mention here: enable debugging in your script and run it like this:

  $SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/etc/apps/myapp/bin/yourscript

and see what happens.

cheers, MuS

View solution in original post

slashnburn
Path Finder

I just struggled with this and I determined the best to accomplish this task is to include the scripts in the $SPLUNK_HOME/bin/scripts folder. Visibility and permissions become a real pain when placing the scripts in a custom app folder.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi vincenteous,

did you place this in /myapp/.. or in $SPLUNK_HOME/etc/apps/myapp/..
Have a look at the docs about scripted inputs where you also get some hints where to put config files.
Another point to mention here: enable debugging in your script and run it like this:

  $SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/etc/apps/myapp/bin/yourscript

and see what happens.

cheers, MuS

vincenteous
Communicator

I placed my files under the $SPLUNK_HOME/etc/apps/myapp/ directory. I suppose something is off in my script. Will try to debug it using that command. Thanks again, MuS.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...