Hi,
I'm trying to update update a stanza within inputs.conf so I can change the cron schedule on a scripted input.
On the setup screen, it displays the value as expected. However, when submitting the page, I get the following error:
Encountered the following error while trying to update: In handler 'localapps': Cannot find item for POST arg_name="/data/inputs/script/%24SPLUNK_HOME%252Fetc%252Fapps%252F<my_app_name>%252Fbin%252F<script>.py/interval"
Looking at the splunkd.log, I found the following error:
08-16-2016 03:33:59.059 -0700 WARN SetupAdminHandler - could not find matching input for POST arg_name=/data/inputs/script/%24SPLUNK_HOME%252Fetc%252Fapps%252F<my_app_name>%252Fbin%252F<script>.py/interval
For reference, here are excerpts from inputs.conf and setup.xml:
[script://$SPLUNK_HOME/etc/apps/<my_app_name>/bin/<script>.py]
passAuth = splunk-system-user
disabled = false
interval = 0 3 * * *
<block title="Add-on settings"
endpoint="data/inputs/script"
entity="%24SPLUNK_HOME%252Fetc%252Fapps%252F<my_app_name>%252Fbin%252F<script>.py">
<input field="interval">
<type>text</type>
</input>
</block>
This seems to match the example in documentation, so I'm not sure what to try. Any tips for debugging this?
I tried defining a custom endpoint, and while it could read the value, it couldn't update it.
https://docs.splunk.com/Documentation/Splunk/6.4.2/AdvancedDev/SetupExample1
I am facing same issue, did you find any solution
Its working fine at linux machine but getting this error on windows
Encountered the following error while trying to update: In handler 'localapps': Cannot find item for POST arg_name="/admin/script/%24SPLUNK_HOME%5Cetc%5Capps%5Cmy_app%5Cbin%5Cmy_script.py%2015/enabled"
inputs.conf:
[script://$SPLUNK_HOME\etc\apps\my_app\bin\my_script.py 15]
disabled = 0
setup.xml:
<block title="my script setting"
endpoint="admin/script"
entity="%24SPLUNK_HOME%5Cetc%5Capps%5CiSIGHTPartners_ThreatScape_App%5Cbin%5Cfetch_indicators.py%2015">
<input field="enabled">
<label>Enable</label>
<type>bool</type>
</input>
</block>
You need to update the entity as follows as per stanza in your inputs.conf
%24SPLUNK_HOME%252Fetc%252Fapps%252F<my_app_name>%252Fbin%252F%3Cscript%3E.py
Also verify that this REST endpoint is available under https://ip:managementport/servicesNS/nobody/
Ah, thanks but the script name was just a placeholder. It's correct in the actual app, I assume, since it loads the cron value from inputs.conf. I've checked and the script appears as an endpoint within the services list.
Thanks, though.