Getting Data In

Splunk errors generated alongside successful data import with input script

Engager

Hi,

I'm getting the following error message from the splunk python code in admin.py (the trace is below in bold) every time my input script gets called. Despite the recurrent error the input script gets all the data imported successfully. I've checked inputs.conf many times and tried different parameters according to the spec to see if it made any difference but no. There are no errors in the script itself. There is no impact on the app functionality but this error pollutes the log which is the issue I'm trying to solve. Any clues what could trigger this?

Thanks

  File "/opt/splunk/lib/python3.7/site-packages/splunk/admin.py", line 137, in init

    mode = ((len(sys.argv) > 1) and sys.argv[1] in ARGS_LIST) and sys.argv[1] or usage()

  File "/opt/splunk/lib/python3.7/site-packages/splunk/admin.py", line 16, in usage

    raise UsageException("Usage: %s [%s].  (Got: %s)" % (sys.argv[0], str.join(str(" | "), ARGS_LIST), sys.argv))

splunk.admin.UsageException: Usage: /opt/splunk/etc/apps/myapp/bin/myscript.py [setup | execute | persistent].  (Got: ['/opt/splunk/etc/apps/myapp/bin/myscript.py'])

 

Labels (1)
0 Karma

Engager

If passing one of these flags, the error is gone but the session key cannot be retrieved anymore so can't get token and other parameters necessary for getting the data

0 Karma

Engager

Yes, but it looks to me that the error message is internal to Splunk (from splunk/sdmin.py). The AppInspect report is clean. My script doesn't need/support any such command flags [setup | execute | persistent]. Or is it required to support these flags? I couldn't find it in the documentation..

0 Karma

SplunkTrust
SplunkTrust
You could test it with command
splunk cmd python <path to your input>
It executes it as it has called as input.
r. Ismo

Engager

That was helpful, saves me a restart, thanks.

Where can I read about the "[setup | execute | persistent]" flags? I was not able to find it in the documentation.

When I provide one of those - the error is gone but I no longer can get the session key with sys.stdin.readline().strip()

0 Karma

SplunkTrust
SplunkTrust
If there haven’t any other instructions then you must read code to get hints. Based on those parameters, I first try with setup and after that with execute. But best option is read docs and/or code.
r. Ismo
0 Karma

Engager

Alright, that was a harmless (caught) exception in some legacy code that produced the SDK error.. would be a breeze to find it if running locally (no license though)

0 Karma

Explorer

From the first look of it:

splunk.admin.UsageException: Usage: /opt/splunk/etc/apps/myapp/bin/myscript.py [setup | execute | persistent].  (Got: ['/opt/splunk/etc/apps/myapp/bin/myscript.py']

 

The usage of execution is throwing exception because script is not being passed one of 3 arguments: setup, execute or persistent.

 

Try passing one as the argument and see if the error goes away. 

0 Karma

Engager

Where can I find the spec for these command flags (setup | execute | persistent)? It looks like they have to be supported to avoid this error message in the log. I cannot find it in the documentation. Thanks

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!