Splunk Search

Custom Command Works in CLI but Fails in Splunk UI

unicornia
New Member

Hello team,

I’ve developed a custom command script that works perfectly when executed through the CLI, but it fails to run in the Splunk Web UI. I suspect this may be due to permissions or configuration issues, as both environments might not be using the same settings.

Details

  • Environment: Splunk Enterprise 9.2.2
  • Script: A custom Python script located in the bin directory of my app.

The script runs successfully when executed via the CLI, but in the UI, it either returns errors or no results.

Troubleshooting Steps Taken

  1. Verified that the script is in the correct bin directory with appropriate execution permissions.
  2. Checked commands.conf, authorization.conf, app.conf files for any configuration inconsistencies.
  3. Ensured that roles in the UI environment have the necessary permissions.

Could this issue be related to role-based restrictions or specific configurations in the UI? Any insights on additional configuration checks or steps to align CLI and UI permissions would be greatly appreciated.

Thank you in advance!

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

as @richgalloway said you must test your python with command "splunk cmd python <..../bin/your script>" If you are using "python <..../bin/your script>" then it use wrong python version. Anyhow you should find hints from _internal logs why it didn't work.

There are couple of presentations how you can do development with splunk, python and vscode.

There are also some other .conf presentations about this same area.

r. Ismo

0 Karma

richgalloway
SplunkTrust
SplunkTrust

When you tested in the CLI, did you use Splunk's python interpreter (splunk cmd python ... )?  If not, then there may be differences in environments that prevent the command from running.  Verify all imported modules are available via Splunk; those that are not should be added to your command's bin/lib directory.

Check python.log for messages that might explain why the command isn't working.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...