Getting Data In

Why I am getting error "Encountered the following error while trying to update: In handler 'localapps': Cannot find item for POST arg_name="/admin/script/%24SPLUNK_HOME%5Cetc%5Capps%5C%5Cbin%5C%2015/enabled" at windows

splunk_mkhan
Explorer

I am trying to update input.conf stanza at windows, it is working fine in linux but giving following error in windows 7.

Encountered the following error while trying to update: In handler 'localapps': Cannot find item for POST arg_name="/admin/script/%24SPLUNK_HOME%5Cetc%5Capps%5Cmy_app%5Cbin%5Cmy_script.py%2015/enabled"

For reference, here are excerpts from inputs.conf and setup.xml:

inputs.conf:

 [script://$SPLUNK_HOME\etc\apps\my_app\bin\my_script.py 15]
     disabled = 0

setup.xml

<block title="my script setting"
            endpoint="admin/script"
            entity="%24SPLUNK_HOME%5Cetc%5Capps%5CiSIGHTPartners_ThreatScape_App%5Cbin%5Cfetch_indicators.py%2015">
    <input field="enabled">
        <label>Enable</label>
        <type>bool</type>
    </input>
</block>

Any help will be appreciated.
thanks,

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi splunk_mkhan,

just some silly question:

  • did you tested your Python script on Windows?
  • have you tried to modify your script using the full address?[script://c:\Programs\splunk\etc\apps\my_app\bin\my_script.py 15]

  • What is 15 at the end of your command?

Bye.
Giuseppe

0 Karma

mkhan_splunk
New Member

Thanks cusello for your response,
. Python script running successfully in app at windows successfully.
. I have tried script using full address ?[script://c:\Programs\splunk\etc\apps\my_app\bin\my_script.py 15]
. 15 at the end of command is argument provided for script interval which is working fine in linux as well as windows.

Actually I am not getting any issue with inputs.conf
my app script is running fine after providing below script path in inputs.conf
path[script://$SPLUNK_HOME\etc\apps\my_app\bin\my_script.py 15]
disabled = 0

I am getting only issue to enable/disable this script from setup page of this app
issue is in below setup.xml block

<block title="my script setting"
             endpoint="admin/script"
             entity="%24SPLUNK_HOME%5Cetc%5Capps%5CiSIGHTPartners_ThreatScape_App%5Cbin%5Cfetch_indicators.py%2015">
     <input field="enabled">
         <label>Enable</label>
         <type>bool</type>
     </input>
 </block>

problem is in provided entity field
entity="%24SPLUNK_HOME%5Cetc%5Capps%5CiSIGHTPartners_ThreatScape_App%5Cbin%5Cfetch_indicators.py%2015 "

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...