Custom Command Works in CLI but Fails in Splunk UI

[unicornia]

Hello team,

I’ve developed a custom command script that works perfectly when executed through the CLI, but it fails to run in the Splunk Web UI. I suspect this may be due to permissions or configuration issues, as both environments might not be using the same settings.

Details

• Environment: Splunk Enterprise 9.2.2
• Script: A custom Python script located in the bin directory of my app.

The script runs successfully when executed via the CLI, but in the UI, it either returns errors or no results.

Troubleshooting Steps Taken

1. Verified that the script is in the correct bin directory with appropriate execution permissions.
2. Checked commands.conf, authorization.conf, app.conf files for any configuration inconsistencies.
3. Ensured that roles in the UI environment have the necessary permissions.

Could this issue be related to role-based restrictions or specific configurations in the UI? Any insights on additional configuration checks or steps to align CLI and UI permissions would be greatly appreciated.

Thank you in advance!

[isoutamo]

Hi

as @richgalloway said you must test your python with command "splunk cmd python <..../bin/your script>" If you are using "python <..../bin/your script>" then it use wrong python version. Anyhow you should find hints from _internal logs why it didn't work.

There are couple of presentations how you can do development with splunk, python and vscode.

• https://www.splunk.com/en_us/blog/it/splunk-enterprise-visual-studio-code-better-together.html
• https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-debug-Python-code-running-in-Splunk-En...
• https://conf.splunk.com/files/2022/slides/DEV1127C.pdf

There are also some other .conf presentations about this same area.

r. Ismo

[richgalloway]

When you tested in the CLI, did you use Splunk's python interpreter (splunk cmd python ... )?  If not, then there may be differences in environments that prevent the command from running.  Verify all imported modules are available via Splunk; those that are not should be added to your command's bin/lib directory.

Check python.log for messages that might explain why the command isn't working.