Getting Data In

Universal Forwarder: Why does the following error appear when I launch a batch file?

atyshke1
Path Finder

Hello,
I have faced this error when launching a batch file with Splunk:

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\SQLFailed_logon\bin\script\LogCheck.bat"" **set was unexpected at this time.**

When I try to run this file by myself it works great. But when the batch starts Splunk Universal Forwarder, it has an error: "set was unexpected at this time"

It's strange that this script works on the similar servers with no errors but other servers with errors.

0 Karma
1 Solution

atyshke1
Path Finder

So the error was because I used script file: runbase.path with the same name for two application.
We need use different name for each application. For example for App1 we need use name runbase_App1.path for second App2 name runbase_App2.path and so on..

View solution in original post

0 Karma

atyshke1
Path Finder

So the error was because I used script file: runbase.path with the same name for two application.
We need use different name for each application. For example for App1 we need use name runbase_App1.path for second App2 name runbase_App2.path and so on..

0 Karma

atyshke1
Path Finder

The script contains a code;
setlocal enabledelayedexpansion
set d=%date:~0,2%
set m=%date:~3,2%
set y=%date:~6,4%
if %d:~0,1%==0 set d=%d:~1%
if %m:~0,1%==0 set m=%m:~1%
set /a feb=y%%4
if %feb%==0 (set feb=29) else (set feb=28)
set /a tok=m-1
if %tok%==0 set tok=12
for /f "tokens=%tok%" %%i in ("31 %feb% 31 30 31 30 31 31 30 31 30 31") do (
:: минус 1 month set /a m-=1
set /a m-=1
if !d!==0 (
set d=%%i
set m=%tok%
if !m!==12 set /a y-=1
)
)
set d=0%d%
set m=0%m%
set lastmonth=%y%-%m:~-2%
echo %lastmonth% > out.txt

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...