Getting Data In

Why I am getting error "Encountered the following error while trying to update: In handler 'localapps': Cannot find item for POST arg_name="/admin/script/%24SPLUNK_HOME%5Cetc%5Capps%5C%5Cbin%5C%2015/enabled" at windows

splunk_mkhan
Explorer

I am trying to update input.conf stanza at windows, it is working fine in linux but giving following error in windows 7.

Encountered the following error while trying to update: In handler 'localapps': Cannot find item for POST arg_name="/admin/script/%24SPLUNK_HOME%5Cetc%5Capps%5Cmy_app%5Cbin%5Cmy_script.py%2015/enabled"

For reference, here are excerpts from inputs.conf and setup.xml:

inputs.conf:

 [script://$SPLUNK_HOME\etc\apps\my_app\bin\my_script.py 15]
     disabled = 0

setup.xml

<block title="my script setting"
            endpoint="admin/script"
            entity="%24SPLUNK_HOME%5Cetc%5Capps%5CiSIGHTPartners_ThreatScape_App%5Cbin%5Cfetch_indicators.py%2015">
    <input field="enabled">
        <label>Enable</label>
        <type>bool</type>
    </input>
</block>

Any help will be appreciated.
thanks,

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi splunk_mkhan,

just some silly question:

  • did you tested your Python script on Windows?
  • have you tried to modify your script using the full address?[script://c:\Programs\splunk\etc\apps\my_app\bin\my_script.py 15]

  • What is 15 at the end of your command?

Bye.
Giuseppe

0 Karma

mkhan_splunk
New Member

Thanks cusello for your response,
. Python script running successfully in app at windows successfully.
. I have tried script using full address ?[script://c:\Programs\splunk\etc\apps\my_app\bin\my_script.py 15]
. 15 at the end of command is argument provided for script interval which is working fine in linux as well as windows.

Actually I am not getting any issue with inputs.conf
my app script is running fine after providing below script path in inputs.conf
path[script://$SPLUNK_HOME\etc\apps\my_app\bin\my_script.py 15]
disabled = 0

I am getting only issue to enable/disable this script from setup page of this app
issue is in below setup.xml block

<block title="my script setting"
             endpoint="admin/script"
             entity="%24SPLUNK_HOME%5Cetc%5Capps%5CiSIGHTPartners_ThreatScape_App%5Cbin%5Cfetch_indicators.py%2015">
     <input field="enabled">
         <label>Enable</label>
         <type>bool</type>
     </input>
 </block>

problem is in provided entity field
entity="%24SPLUNK_HOME%5Cetc%5Capps%5CiSIGHTPartners_ThreatScape_App%5Cbin%5Cfetch_indicators.py%2015 "

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...