Why is cmd script not running?

[pbnl]

hi all,

i try to run a cmd script on a UF.  it's located in %SPLUNK_HOME%\etc\apps\log4jscan\bin\log4jscan.cmd and the content is
..\static\log4j2-scan.exe --all-drives --scan-log4j1 --scan-logback --csv-log-path "%SPLUNK_HOME%\var\log\log4jscan" 

the inputs.conf is in %SPLUNK_HOME%\etc\apps\log4jscan\default and looks like this: (interval will be changed to run once per month)
[script://..\bin\log4jscan.cmd]
disabled = False
interval = 600

i added> debug.txt 2>&1 to the script, but no file is created.
any ideas?

thanks...

[richgalloway]

Does the log4j2-scan command work if run manually?  Does Splunk have permission to run the command?  Have you checked the UF's logs for messages that might explain why the script doesn't run?

[pbnl · Accepted solution]

after finding out that i have to change execprocessor logging mode to DEBUG, it shows, that the problem was with the path. after struggling around with that, i ended up with this:

inputs.conf
[script://$SPLUNK_HOME/etc/apps/PBNL_log4jscanWIN/bin/log4jscan.cmd]
disabled = False
interval = 15 0 1 * *
[monitor://C:\Program Files\SplunkUniversalForwarder\var\log\log4jscan.log]
disabled = false
sourcetype = log4jscan

log4jscan.cmd
"%SPLUNK_HOME%\etc\apps\PBNL_log4jscanWIN\static\log4j2-scan.exe" --all-drives --scan-log4j1 --scan-logback --csv-log-path "%SPLUNK_HOME%\var\log\log4jscan.log"

as you can see, it's a windows/linux mix of notation styles, where the monitor clause does'nt resolve variables.
from other posts i assuemed, the "base path" for an app is in my case %SPLUNK_HOME%\etc\apps\PBNL_log4jscanWIN\. but that seems to be not the case.

anyway, learned some new stuff...