Splunk Search

Custom modules not loading

joonradley
Path Finder

Hi,

I have created some custom modules, but receive warnings that the module cannot be found when opening the view containing the modules.

Originally the modules where created under the following directories:

$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/search/mod1.conf
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/search/mod1.js
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/prototype/mod2.conf
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/prototype/mod2.js

The modules showed up under splunk.xxx.com:8000/modules and modules loaded correctly when the view was loaded.

I then moved the modules to the app directory:

$SPLUNK_HOME/etc/apps/myapp/appserver/modules/mod1.conf
$SPLUNK_HOME/etc/apps/myapp/appserver/modules/mod1.js
$SPLUNK_HOME/etc/apps/myapp/appserver/modules/mod2.conf
$SPLUNK_HOME/etc/apps/myapp/appserver/modules/mod2.js

The modules showed up under splunk.xxx.com:8000/modules with the new paths, but when loading the view containing them I get the error - Splunk encountered the following unknown module: "mod1" . The view may not load properly.

Next I moved the modules back to the share directory, but under a new sub directory:

$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/mymods/mod1.conf
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/mymods/mod1.js
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/mymods/mod2.conf
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/mymods/mod2.js

Again the modules showed up under splunk.xxx.com:8000/modules with the new paths, but when loading the view containing the modules I get the same error message as above.

When I moved the modules back to the original directories where they where developed all worked fine again.

Can any one tell me what I am doing wrong?

Regards

Joon

Tags (1)

sideview
SplunkTrust
SplunkTrust

fwiw I found the mistake I'd made that was preventing them from loading. In the .conf file I listed the classname as instead of Splunk.Module. . Once i fixed that they worked like a charm.

zscgeek
Path Finder

I was able to get a custom mod working after much hair pulling however it was touch ago go every step of the way.

This is what I have for a file layout:

First Mod

./etc/apps/prophecy-premise/appserver/modules/VAppBar/VAppBar.conf
./etc/apps/prophecy-premise/appserver/modules/VAppBar/VAppBar.css
./etc/apps/prophecy-premise/appserver/modules/VAppBar/VAppBar.html
./etc/apps/prophecy-premise/appserver/modules/VAppBar/VAppBar.js

Second Mod

./etc/apps/prophecy-premise/appserver/modules/VTitleBar/VTitleBar.conf
./etc/apps/prophecy-premise/appserver/modules/VTitleBar/VTitleBar.css
./etc/apps/prophecy-premise/appserver/modules/VTitleBar/VTitleBar.html
./etc/apps/prophecy-premise/appserver/modules/VTitleBar/VTitleBar.js

I put each mod in it's own folder in order to get it to load. I am pretty sure this is critical for it to work.

Please note that the JS script is VERY VERY finicky. If there are any errors whatsoever in your code it will silently fail with the error you are seeing above.

My pain and suffering is documented on the answers page over at How to get rid of warning for custom modules?

sideview
SplunkTrust
SplunkTrust

I know it has been years, but for the record another thing that can seriously cause confusion, is that if you have any other app installed that has a directory by that name inside appserver, and a partial set of files therein, or a modulename.conf file in it with a typo, Splunk is very bad about logging anything about the duplicate module and both versions of the module will just quietly die.

0 Karma

joonradley
Path Finder

Thank you for your responses.

I thought I would just give feedback on your suggestions.

@zscgeek: Your suggestion of placing each module in its won directory using the module name as the directory name did not work for me. I tried different capitulation. Neither did the module named directories work under the share/splunk/mr_sparkle/ modules direrctory.

@zscgeek: The javascript works 100% when the modules are placed under the normal directories.

@nick: In my case the class name is already Splunk.Module.<modulename>.

I will work try again to resolve this next month when we work on the second version of the app.

0 Karma

sideview
SplunkTrust
SplunkTrust

I have not been able to get custom modules working either, and im similarly baffled. sorry i cant help but im also interested. I know people have done it so maybe they can see what you/we are doing wrong.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...