Getting Data In

Universal Forwarder: Why does the following error appear when I launch a batch file?

atyshke1
Path Finder

Hello,
I have faced this error when launching a batch file with Splunk:

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\SQLFailed_logon\bin\script\LogCheck.bat"" **set was unexpected at this time.**

When I try to run this file by myself it works great. But when the batch starts Splunk Universal Forwarder, it has an error: "set was unexpected at this time"

It's strange that this script works on the similar servers with no errors but other servers with errors.

0 Karma
1 Solution

atyshke1
Path Finder

So the error was because I used script file: runbase.path with the same name for two application.
We need use different name for each application. For example for App1 we need use name runbase_App1.path for second App2 name runbase_App2.path and so on..

View solution in original post

0 Karma

atyshke1
Path Finder

So the error was because I used script file: runbase.path with the same name for two application.
We need use different name for each application. For example for App1 we need use name runbase_App1.path for second App2 name runbase_App2.path and so on..

0 Karma

atyshke1
Path Finder

The script contains a code;
setlocal enabledelayedexpansion
set d=%date:~0,2%
set m=%date:~3,2%
set y=%date:~6,4%
if %d:~0,1%==0 set d=%d:~1%
if %m:~0,1%==0 set m=%m:~1%
set /a feb=y%%4
if %feb%==0 (set feb=29) else (set feb=28)
set /a tok=m-1
if %tok%==0 set tok=12
for /f "tokens=%tok%" %%i in ("31 %feb% 31 30 31 30 31 31 30 31 30 31") do (
:: минус 1 month set /a m-=1
set /a m-=1
if !d!==0 (
set d=%%i
set m=%tok%
if !m!==12 set /a y-=1
)
)
set d=0%d%
set m=0%m%
set lastmonth=%y%-%m:~-2%
echo %lastmonth% > out.txt

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...