Getting Data In

Why is the script failing with parse interval error when pushed as App from Deployment server?

mallempatisreed
Explorer

hi Team,

We are using a script to read files at regular intervals of time 900 seconds. It is working fine in our production environment where we have copied the script as an app manually. In our test environment when we pushed the App from Deployment server it is failing with Parse error.

02-20-2018 07:15:30.434 +0100 ERROR ExecProcessor - Can't parse interval "900 #frequency to run the script, in seconds", ignoring script: "/app/splunkforwarder/etc/apps/TA_goep_esbsrv_foldermonitoring_CI/bin/filewatchError.sh"

Am using the below App.

TA_goep_esbsrv_foldermonitoring_CI App with bin and local folders.

local has inputs.conf

inputs.conf
[script://$SPLUNK_HOME/etc/apps/TA_goep_esbsrv_foldermonitoring_CI/bin/filewatchError.sh]
host = SERVERNAME
index = esbsrvtest
interval = 900   #frequency to run the script, in seconds
sourcetype = foldermonitoringError

bin folder has files to monitor and sh script.

 cat filewatchError.sh
#!/bin/bash
file="/app/splunkforwarder/etc/apps/TA_goep_esbsrv_foldermonitoring_CI/bin/error-folders-CI.txt"
#Check the white space and stop before new line
while IFS= read -r var || [[ -n $var ]]
do
        #Check directory if exists
        if [ -d "$var" ]
        then
                #find the count of files on directory posted before 3 min
                number=$(find "$var" -type f | wc -l)

                if [ "$number" -gt 0 ]
                then
                        #echo "$(find "$var" -type f -printf '%TD %Tc filePath=%p timeModified=%TY-%Tm-%Td %TH:%TM\n')"
                        #echo "$(date) $(find "$var" -type f -printf 'filePath=%p timeModified=%TY-%Tm-%Td %TH:%TM\n')"
                        /usr/bin/find "$var" -type f -printf 'filePath=%p timeModified=%TY-%Tm-%Td %TH:%TM\n' | /usr/bin/xargs -I {} echo "$(date) {}"
                fi
        fi
done <"$file"

What can be wrong as it is working when it has been copied manually and it's not working when pushed from the Deployment server.

Thanks,
Sreedhar

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

End of line comments are not allowed in .conf files.
see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Howtoeditaconfigurationfile#Insert_a_commen...

instead of

 interval = 900   #frequency to run the script, in seconds

put your comment on the next line

 interval = 900   
#frequency to run the script, in seconds

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

End of line comments are not allowed in .conf files.
see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Howtoeditaconfigurationfile#Insert_a_commen...

instead of

 interval = 900   #frequency to run the script, in seconds

put your comment on the next line

 interval = 900   
#frequency to run the script, in seconds
0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...