Getting Data In

Why I am getting error "Encountered the following error while trying to update: In handler 'localapps': Cannot find item for POST arg_name="/admin/script/%24SPLUNK_HOME%5Cetc%5Capps%5C%5Cbin%5C%2015/enabled" at windows

splunk_mkhan
Explorer

I am trying to update input.conf stanza at windows, it is working fine in linux but giving following error in windows 7.

Encountered the following error while trying to update: In handler 'localapps': Cannot find item for POST arg_name="/admin/script/%24SPLUNK_HOME%5Cetc%5Capps%5Cmy_app%5Cbin%5Cmy_script.py%2015/enabled"

For reference, here are excerpts from inputs.conf and setup.xml:

inputs.conf:

 [script://$SPLUNK_HOME\etc\apps\my_app\bin\my_script.py 15]
     disabled = 0

setup.xml

<block title="my script setting"
            endpoint="admin/script"
            entity="%24SPLUNK_HOME%5Cetc%5Capps%5CiSIGHTPartners_ThreatScape_App%5Cbin%5Cfetch_indicators.py%2015">
    <input field="enabled">
        <label>Enable</label>
        <type>bool</type>
    </input>
</block>

Any help will be appreciated.
thanks,

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi splunk_mkhan,

just some silly question:

  • did you tested your Python script on Windows?
  • have you tried to modify your script using the full address?[script://c:\Programs\splunk\etc\apps\my_app\bin\my_script.py 15]

  • What is 15 at the end of your command?

Bye.
Giuseppe

0 Karma

mkhan_splunk
New Member

Thanks cusello for your response,
. Python script running successfully in app at windows successfully.
. I have tried script using full address ?[script://c:\Programs\splunk\etc\apps\my_app\bin\my_script.py 15]
. 15 at the end of command is argument provided for script interval which is working fine in linux as well as windows.

Actually I am not getting any issue with inputs.conf
my app script is running fine after providing below script path in inputs.conf
path[script://$SPLUNK_HOME\etc\apps\my_app\bin\my_script.py 15]
disabled = 0

I am getting only issue to enable/disable this script from setup page of this app
issue is in below setup.xml block

<block title="my script setting"
             endpoint="admin/script"
             entity="%24SPLUNK_HOME%5Cetc%5Capps%5CiSIGHTPartners_ThreatScape_App%5Cbin%5Cfetch_indicators.py%2015">
     <input field="enabled">
         <label>Enable</label>
         <type>bool</type>
     </input>
 </block>

problem is in provided entity field
entity="%24SPLUNK_HOME%5Cetc%5Capps%5CiSIGHTPartners_ThreatScape_App%5Cbin%5Cfetch_indicators.py%2015 "

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...