Why is the script failing with parse interval error when pushed as App from Deployment server?

[mallempatisreed]

hi Team,

We are using a script to read files at regular intervals of time 900 seconds. It is working fine in our production environment where we have copied the script as an app manually. In our test environment when we pushed the App from Deployment server it is failing with Parse error.

02-20-2018 07:15:30.434 +0100 ERROR ExecProcessor - Can't parse interval "900 #frequency to run the script, in seconds", ignoring script: "/app/splunkforwarder/etc/apps/TA_goep_esbsrv_foldermonitoring_CI/bin/filewatchError.sh"

Am using the below App.

TA_goep_esbsrv_foldermonitoring_CI App with bin and local folders.

local has inputs.conf

inputs.conf
[script://$SPLUNK_HOME/etc/apps/TA_goep_esbsrv_foldermonitoring_CI/bin/filewatchError.sh]
host = SERVERNAME
index = esbsrvtest
interval = 900   #frequency to run the script, in seconds
sourcetype = foldermonitoringError

bin folder has files to monitor and sh script.

 cat filewatchError.sh
#!/bin/bash
file="/app/splunkforwarder/etc/apps/TA_goep_esbsrv_foldermonitoring_CI/bin/error-folders-CI.txt"
#Check the white space and stop before new line
while IFS= read -r var || [[ -n $var ]]
do
        #Check directory if exists
        if [ -d "$var" ]
        then
                #find the count of files on directory posted before 3 min
                number=$(find "$var" -type f | wc -l)

                if [ "$number" -gt 0 ]
                then
                        #echo "$(find "$var" -type f -printf '%TD %Tc filePath=%p timeModified=%TY-%Tm-%Td %TH:%TM\n')"
                        #echo "$(date) $(find "$var" -type f -printf 'filePath=%p timeModified=%TY-%Tm-%Td %TH:%TM\n')"
                        /usr/bin/find "$var" -type f -printf 'filePath=%p timeModified=%TY-%Tm-%Td %TH:%TM\n' | /usr/bin/xargs -I {} echo "$(date) {}"
                fi
        fi
done <"$file"

What can be wrong as it is working when it has been copied manually and it's not working when pushed from the Deployment server.

Thanks,
Sreedhar

[yannK · Accepted solution]

End of line comments are not allowed in .conf files.
see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Howtoeditaconfigurationfile#Insert_a_commen...

instead of

 interval = 900   #frequency to run the script, in seconds

put your comment on the next line

 interval = 900   
#frequency to run the script, in seconds