Splunk ExecProcessor can't find .bat script

[Choi_Hyun]

Hello,

I have a simple .bat file that just performs a "dir" command to list everything in a folder. 

I have set the input.conf to the following:

[script://.\bin\ListDir.bat]
disabled = 0
## Run Every Ten Seconds
interval = 10
sourcetype = Script:ListDir
index = main

I have placed my ListDir.bat in the application's \bin\ folder.
When I run the command: splunk cmd ListDir.bat, splunk runs the bat files no problem, displaying all the files I want Splunk to ingest.

However, looking at my Splunkd logs, I see that ExecProcessor lists the exact location where the bat file exists and reads "The system cannot find the file specified."

ERROR ExecProcessor [11384 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_Burn_Folder\bin\ListDir.bat"" The system cannot find the file specified.

I looked at the file permissions and I gave everyone access to this bat file.

Any help is appreciated.

[Choi_Hyun · Accepted solution]

After few days of work, I figured out that the bat file literally could not find the file. Depending on who is running the bat file (SYSTEM in this case) it changed the environment variable and the folder did not exist.