Splunk Search

Custom Command Works in CLI but Fails in Splunk UI

unicornia
New Member

Hello team,

I’ve developed a custom command script that works perfectly when executed through the CLI, but it fails to run in the Splunk Web UI. I suspect this may be due to permissions or configuration issues, as both environments might not be using the same settings.

Details

  • Environment: Splunk Enterprise 9.2.2
  • Script: A custom Python script located in the bin directory of my app.

The script runs successfully when executed via the CLI, but in the UI, it either returns errors or no results.

Troubleshooting Steps Taken

  1. Verified that the script is in the correct bin directory with appropriate execution permissions.
  2. Checked commands.conf, authorization.conf, app.conf files for any configuration inconsistencies.
  3. Ensured that roles in the UI environment have the necessary permissions.

Could this issue be related to role-based restrictions or specific configurations in the UI? Any insights on additional configuration checks or steps to align CLI and UI permissions would be greatly appreciated.

Thank you in advance!

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

as @richgalloway said you must test your python with command "splunk cmd python <..../bin/your script>" If you are using "python <..../bin/your script>" then it use wrong python version. Anyhow you should find hints from _internal logs why it didn't work.

There are couple of presentations how you can do development with splunk, python and vscode.

There are also some other .conf presentations about this same area.

r. Ismo

0 Karma

richgalloway
SplunkTrust
SplunkTrust

When you tested in the CLI, did you use Splunk's python interpreter (splunk cmd python ... )?  If not, then there may be differences in environments that prevent the command from running.  Verify all imported modules are available via Splunk; those that are not should be added to your command's bin/lib directory.

Check python.log for messages that might explain why the command isn't working.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...