Getting Data In

Splunk errors generated alongside successful data import with input script

ayuri
Engager

Hi,

I'm getting the following error message from the splunk python code in admin.py (the trace is below in bold) every time my input script gets called. Despite the recurrent error the input script gets all the data imported successfully. I've checked inputs.conf many times and tried different parameters according to the spec to see if it made any difference but no. There are no errors in the script itself. There is no impact on the app functionality but this error pollutes the log which is the issue I'm trying to solve. Any clues what could trigger this?

Thanks

  File "/opt/splunk/lib/python3.7/site-packages/splunk/admin.py", line 137, in init

    mode = ((len(sys.argv) > 1) and sys.argv[1] in ARGS_LIST) and sys.argv[1] or usage()

  File "/opt/splunk/lib/python3.7/site-packages/splunk/admin.py", line 16, in usage

    raise UsageException("Usage: %s [%s].  (Got: %s)" % (sys.argv[0], str.join(str(" | "), ARGS_LIST), sys.argv))

splunk.admin.UsageException: Usage: /opt/splunk/etc/apps/myapp/bin/myscript.py [setup | execute | persistent].  (Got: ['/opt/splunk/etc/apps/myapp/bin/myscript.py'])

 

Labels (1)
0 Karma

ayuri
Engager

If passing one of these flags, the error is gone but the session key cannot be retrieved anymore so can't get token and other parameters necessary for getting the data

0 Karma

ayuri
Engager

Yes, but it looks to me that the error message is internal to Splunk (from splunk/sdmin.py). The AppInspect report is clean. My script doesn't need/support any such command flags [setup | execute | persistent]. Or is it required to support these flags? I couldn't find it in the documentation..

0 Karma

isoutamo
SplunkTrust
SplunkTrust
You could test it with command
splunk cmd python <path to your input>
It executes it as it has called as input.
r. Ismo

ayuri
Engager

That was helpful, saves me a restart, thanks.

Where can I read about the "[setup | execute | persistent]" flags? I was not able to find it in the documentation.

When I provide one of those - the error is gone but I no longer can get the session key with sys.stdin.readline().strip()

0 Karma

isoutamo
SplunkTrust
SplunkTrust
If there haven’t any other instructions then you must read code to get hints. Based on those parameters, I first try with setup and after that with execute. But best option is read docs and/or code.
r. Ismo
0 Karma

ayuri
Engager

Alright, that was a harmless (caught) exception in some legacy code that produced the SDK error.. would be a breeze to find it if running locally (no license though)

0 Karma

kbehl
Explorer

From the first look of it:

splunk.admin.UsageException: Usage: /opt/splunk/etc/apps/myapp/bin/myscript.py [setup | execute | persistent].  (Got: ['/opt/splunk/etc/apps/myapp/bin/myscript.py']

 

The usage of execution is throwing exception because script is not being passed one of 3 arguments: setup, execute or persistent.

 

Try passing one as the argument and see if the error goes away. 

0 Karma

ayuri
Engager

Where can I find the spec for these command flags (setup | execute | persistent)? It looks like they have to be supported to avoid this error message in the log. I cannot find it in the documentation. Thanks

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...