Getting Data In

Scripts : path to executables (perl)

bdunstan
Path Finder

When running an external script, where is the executable defined ?

That is, it always seems to call /usr/bin/perl and I want it to use a different installation.

Is the location of perl defined in a configuration file or is it taking it from the splunk-users environment ?

Tags (2)
0 Karma

bdunstan
Path Finder

I have that in the perl script, but it appears from the splunk logfile, it is calling it with /usr/bin/perl script.pl - therefore splunk is trumping the #!/usr/local/bin/perl that is defined in script.pl.

I have in commands.conf

[script]
filename = script.pl
type = perl

I was wondering if there was a way to define which perl it is using, ie: path, which is then used for perl/python/shell(bash) etc...

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Ah-ha. Commands.conf is a bit different. If you do the following command you will see the following first two lines of the result as shown below:

$ strings splunkd | grep perl
perl
/usr/bin/perl

What you see is that there is a high likelihood that the type from the commands.conf file is special (because if you use type = python, then it will run the python script through Splunk's python interpreter. So it might be that the script is run through a predefined location for perl.

Could you create a symbolic link to /usr/local/bin/perl in /usr/bin:

ls -s /usr/local/bin/perl /usr/bin/

This is not an ideal solution, but it should take care of your problem.

I haven't seen any examples or documentation that specifically references this kind of issue, but most systems today have perl preinstalled in /usr/bin, so that could be the reason that it made sense for the Splunk engineers to do something like this. Like I say, I don't know if this is really the case, but it seems likely.

0 Karma

bdunstan
Path Finder

I dont have permission to do a symlink back to /usr/bin and I also dont want to break anything by overwriting /usr/bin/perl with /usr/local/bin/perl.

The other thing I can think of is to use a shell/perl/python script and call it from there with the required perl, but that seems like a hack - I read somewhere that only perl/python are viable scripts - so maybe shell wouldnt work ?

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

You can create a perl or python wrapper script and set up the /usr/local/bin/perl as the perl binary to be used instead of /usr/bin/perl. If you use Perl, use a fork() with the arguments starting with "/usr/local/bin/perl" and the second argument being the script you want to run. That should do the trick for you as well.

0 Karma

bdunstan
Path Finder

Thanks. I have done something similar and it works fine now - but would be nice if there is the ability to specify an 'exec-path' as a config.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Create an answer with the details of what you did, then accept your answer as the accepted answer, then the question will be marked with an accepted answer and others can find it more compelling to look at. You'll also get karma points for answering the question.

Good work! 🙂

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

The first line of the script file will usually tell you where it is looking for the perl binary. For example:

#! /usr/bin/perl

is going to look for perl in /usr/bin, while

#! /usr/local/bin/perl

would look for it in /usr/local/bin instead. If you want to use it in a different location, just set the location in the first line of the perl script as shown in the examples above. If there is no similar line at the top of your script, just add a first line like the examples. The slash-exclamation (often referred to as sh-bang) is the way that the scripts tell the binary used by script files.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...