All Apps and Add-ons

JMX_ta app with Universal Forwarder

trebaum
New Member

I want to be able to install the jmx_ta app on a Universalforwarder. I've read a lot of questions on here and the default answer seems to be "Install a python runtime and it "should" work. It doesn't. As soon as I provide a python runtime for splunk, when restarting the process, I get the following error...


    $ sudo /opt/splunkforwarder/bin/splunk start
    Checking prerequisites...
    Checking mgmt port [8089]: open
    Checking configuration...  Done.
    Checking critical directories...        Done
    Checking indexes...  Problem parsing indexes.conf: stanza=default Required parameter=blockSignatureDatabase not configured.  
    Validating databases (splunkd validatedb) failed with code '1'.  If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue

Before adding the runtime, it would never ( visibly ) check the 'critical directories' and the 'indexes'. I don't intend on doing any indexing on this server at all. I just want to foward the raw data to the search head.

I would also like to point out that I have this working on a test box using a FULL install of Splunk. I need to get it working on the UniversalForwarder. Any ideas? Thanks

0 Karma

messes
Engager

I had this issue myself on Windows, because PYTHONPATH and PYTHONHOME weren't set for the account under which Splunk was running. Until these were set correctly the UF went looking for Splunk specific python scripts and locations. Further I had to ensure that both of these locations were in the PATH before splunk used a remote python exe

Make sure Python.exe isn't in the Splunk path and the above is set should get the app working for you.

0 Karma

trebaum
New Member
  1. I have attempted to use the system python, but I'm getting an error that there is a module missing:

ImportError: No module named site

  1. Yes I did remove the indexes file in the default dir of the jmx_ta app, and that didn't help.
0 Karma

Damien_Dallimor
Ultra Champion

I don't really see how that error relates to python.

Try removing the indexes.conf file that comes with the JMX app. You don't need this on the UF for a distributed deployment.

0 Karma

Damien_Dallimor
Ultra Champion

It was not written with dependencies on any python libs that come with the python runtime that comes with splunk.

0 Karma

trebaum
New Member

And if it does, can you please list them for me. Thank you Damien.

0 Karma

trebaum
New Member

They aren't currently set server wide. They end up defaulting to $SPLUNK_HOME/bin/python2.7 and $SPLUNK_HOME/lib/python2.7.

If I set the ENV var for each of those to the system python, I get the same error. I believe it is because this application was written against the specific python libs that come with the full install of splunk.

Since you wrote the application, can you clear up a question for me? Does this app ( jmx_ta ) require splunk specific python libraries?

0 Karma

Damien_Dallimor
Ultra Champion

Check your PYTHONPATH / PYTHONHOME environment variables

0 Karma

trebaum
New Member

1) I have attempted to use the system python, but I'm getting an error that there is a module missing:

ImportError: No module named site

2) Yes I did remove the indexes file in the default dir of the jmx_ta app, and that didn't help.

0 Karma

Damien_Dallimor
Ultra Champion

1) Install python as per instructions (ie: don't copy Splunk's python runtime over , use your own system python install) : http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Introducingtheuniversalforwarder

2) Have you tried my suggestion listed above.

0 Karma

trebaum
New Member

Understood, I don't necessarily see how it relates as well. Which is why i'm confused.
Here's the steps to reproduce it.
1. Use ubuntu
2. Install Splunk UF
3. Install jmx_ta app
4. Copy python binary ( and create links ) from full installation to the same location on the UF.
5. Copy over python library ( /opt/splunk/lib/python2.7/ ) to appropriate location on UF ( /opt/splunkforwarder/lib/python2.7 )
6. Start splunk. You will see the same error.

On a side note, I've also tried creating links in splunkfowarder/bin to the system python2.7 installed and that complains of a linking issue.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...