Splunk Search

Custom modules not loading

joonradley
Path Finder

Hi,

I have created some custom modules, but receive warnings that the module cannot be found when opening the view containing the modules.

Originally the modules where created under the following directories:

$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/search/mod1.conf
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/search/mod1.js
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/prototype/mod2.conf
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/prototype/mod2.js

The modules showed up under splunk.xxx.com:8000/modules and modules loaded correctly when the view was loaded.

I then moved the modules to the app directory:

$SPLUNK_HOME/etc/apps/myapp/appserver/modules/mod1.conf
$SPLUNK_HOME/etc/apps/myapp/appserver/modules/mod1.js
$SPLUNK_HOME/etc/apps/myapp/appserver/modules/mod2.conf
$SPLUNK_HOME/etc/apps/myapp/appserver/modules/mod2.js

The modules showed up under splunk.xxx.com:8000/modules with the new paths, but when loading the view containing them I get the error - Splunk encountered the following unknown module: "mod1" . The view may not load properly.

Next I moved the modules back to the share directory, but under a new sub directory:

$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/mymods/mod1.conf
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/mymods/mod1.js
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/mymods/mod2.conf
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/mymods/mod2.js

Again the modules showed up under splunk.xxx.com:8000/modules with the new paths, but when loading the view containing the modules I get the same error message as above.

When I moved the modules back to the original directories where they where developed all worked fine again.

Can any one tell me what I am doing wrong?

Regards

Joon

Tags (1)

sideview
SplunkTrust
SplunkTrust

fwiw I found the mistake I'd made that was preventing them from loading. In the .conf file I listed the classname as instead of Splunk.Module. . Once i fixed that they worked like a charm.

zscgeek
Path Finder

I was able to get a custom mod working after much hair pulling however it was touch ago go every step of the way.

This is what I have for a file layout:

First Mod

./etc/apps/prophecy-premise/appserver/modules/VAppBar/VAppBar.conf
./etc/apps/prophecy-premise/appserver/modules/VAppBar/VAppBar.css
./etc/apps/prophecy-premise/appserver/modules/VAppBar/VAppBar.html
./etc/apps/prophecy-premise/appserver/modules/VAppBar/VAppBar.js

Second Mod

./etc/apps/prophecy-premise/appserver/modules/VTitleBar/VTitleBar.conf
./etc/apps/prophecy-premise/appserver/modules/VTitleBar/VTitleBar.css
./etc/apps/prophecy-premise/appserver/modules/VTitleBar/VTitleBar.html
./etc/apps/prophecy-premise/appserver/modules/VTitleBar/VTitleBar.js

I put each mod in it's own folder in order to get it to load. I am pretty sure this is critical for it to work.

Please note that the JS script is VERY VERY finicky. If there are any errors whatsoever in your code it will silently fail with the error you are seeing above.

My pain and suffering is documented on the answers page over at How to get rid of warning for custom modules?

sideview
SplunkTrust
SplunkTrust

I know it has been years, but for the record another thing that can seriously cause confusion, is that if you have any other app installed that has a directory by that name inside appserver, and a partial set of files therein, or a modulename.conf file in it with a typo, Splunk is very bad about logging anything about the duplicate module and both versions of the module will just quietly die.

0 Karma

joonradley
Path Finder

Thank you for your responses.

I thought I would just give feedback on your suggestions.

@zscgeek: Your suggestion of placing each module in its won directory using the module name as the directory name did not work for me. I tried different capitulation. Neither did the module named directories work under the share/splunk/mr_sparkle/ modules direrctory.

@zscgeek: The javascript works 100% when the modules are placed under the normal directories.

@nick: In my case the class name is already Splunk.Module.<modulename>.

I will work try again to resolve this next month when we work on the second version of the app.

0 Karma

sideview
SplunkTrust
SplunkTrust

I have not been able to get custom modules working either, and im similarly baffled. sorry i cant help but im also interested. I know people have done it so maybe they can see what you/we are doing wrong.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2026-2027 SplunkTrust is officially open. If ...