Splunk Dev

How to troubleshoot why my basic custom Python command is not working?

clorne
Communicator

I would like to develop a python custom search command. At this time, my script does nothing but generates errors.

Here is the script monitor.py (located in Splunk/etc/apps/HOME_COM/bin):

import splunk.Intersplunk as si
results = si.getOrganizedResults()
si.outputResults(results)

In Splunk/etc/apps/HOME_COM/local/commands.conf I added

[monitore]
filename = monitore.py
streaming = true
enableheader = true
run_in_preview = true
local = false
retainsevents = true

Then in my app : HOME_COM

 * |head 10|monitore

I systematically get the following error:

External search command 'monitore' returned error code 1.

I found also in Activity->System activity-> Internal Errors and Messages the following error that occurs each time I call the "monitore" command.

10-19-2015 21:41:37.557 +0200 ERROR ExecProcessor - message from "/Applications/Splunk/etc/apps/routemap/bin/launch_app.sh" /bin/sh: /Applications/Splunk/etc/apps/routemap/bin/launch_app.sh: Permission denied

Regards

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi clorne,

For better troubleshooting, take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/AdvancedDev/ModInputsLog to add some error logging features in your script and find the errors either in index=_internal ExecProcessor or splunkd.log.

The other error is not related to your script, it's from the routemap app - but you have the wrong permission on it; probably x bit missing.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi clorne,

For better troubleshooting, take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/AdvancedDev/ModInputsLog to add some error logging features in your script and find the errors either in index=_internal ExecProcessor or splunkd.log.

The other error is not related to your script, it's from the routemap app - but you have the wrong permission on it; probably x bit missing.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...