All Apps and Add-ons

Splunk crashes when i restart, have to rename config files

ductom2002
New Member

Splunk crashes after restart. If i rename the config files its starts without a problem.

Version is 5.01

My configs:

input.conf

[monitor:///mnt/netapp/vol0_filer0/etc/log]
disabled = false
followTail = 0
host_segment = 3
index = netapp
blacklist = (stats)|(/mlog/.last_rotate)|(/log/autosupport)

[monitor:///mnt/netapp/vol0_filer1/etc/log]
disabled = false
followTail = 0
host_segment = 3
index = netapp
blacklist = (stats)|(/mlog/.last_rotate)|(/log/autosupport)

[script://$SPLUNK_HOME/etc/apps/SplunkAppforNetApp/bin/SNap.py -h 01]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

snap_hosts.csv

10.2.X.X, user_api, somepass
10.2.X.X, user_api, somepass

0 Karma

ductom2002
New Member

@piebob

Sure, i'd edit inputs.conf (just a typo 😉

0 Karma

halr9000
Motivator

The third stanza "script://$SPLUNK_HOME/etc/apps/SplunkAppforNetApp/bin/SNap.py -h 01" is not necessary unless you are intentionally wanting to gather multiple sets of stats from different filers. The scripted input in default/inputs.conf (looks similar minus the "-h 01" portion) is all that you need in most cases. At the very least, remove this last stanza and see how that goes.

Adding the H parameter (which we haven't documented yet) requires that you create additional csv files for telling it what you want counters to grab. If that file is missing, I suppose it could cause the python script to throw an exception. That shouldn't crash Splunk, though.

halr9000
Motivator

note that we converted your review to a question so that we can interact and points can be awarded, and so on. thanks!

piebob
Splunk Employee
Splunk Employee

what config files are you renaming?
the inputs.conf file should be called inputs.conf, not input.conf, is this the problem?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...