Scripted inputs fails on pooled search heads

[richnavis]

I am trying to implement the Cisco IPS App on pooled search heads, but the scripted inputs are failing with the following error: Incorrect path to script: \\Server01\prod\SplunkSharedConfig\etc\apps\Splunk_CiscoIPS\bin\get_ips_feed.py. Script must be in a bin subdirectory in $SPLUNK_HOME.

I've tested the path and it is correct. Anyone have any thoughts?

[Damien_Dallimor]

It looks as if you have placed your input script in your Search Head pools shared storage path hence the error saying that the script must live within $SPLUNK_HOME , //Server01/prod/SplunkSharedConfig is not your $SPLUNK_HOME

You will need to place the script where Splunk is installed ie: $SPLUNK_HOME/etc/apps/Splunk_CiscoIPS/bin/get_ips_feed.py

[Damien_Dallimor]

You still have the apps shared via shared storage , but what you are doing in a distributed setup is splitting out the various components of the app.In this case you are splitting out the data collection components(get_ips_feed.py), which could possibly live on a Splunk forwarder or indexer, from the data viewing and searching components(views, alerts, saved searches,eventtypes, lookups & various other knowledge objects) which can live on your search head pools shared storage path.

[richnavis]

Makes sense.. but apps in searchhead pools aren't really shared if they are installed locally..