Getting Data In

Problem running Custom Script

Greg_LeBlanc
Path Finder

Have created a custom Perl script, added it to commands.conf - it finds the script just fine. The script outputs the correct data, but whenever I run it Splunk gives me these errors:

External search command 'get_asn' returned error code 9. Script output = "String found where operator expected at /services/splunk/bin/runScript.py line 19, near """ (Might be a runaway multi-line "" string starting on line 1) (Missing semicolon on previous line?) String found where operator expected at /services/splunk/bin/runScript.py line 19, near """"" (Missing operator before ""?) Semicolon seems to be missing at /services/splunk/bin/runScript.py line 20. Bareword found where operator expected at /services/splunk/bin/runScript.py line 25, near ""UNIT_TEST_EXTRA_LOGGING" in" (Missing operator before in?) syntax error at /services/splunk/bin/runScript.py line 19, near """ Execution of /services/splunk/bin/runScript.py aborted due to compilation errors. "

I've looked over the runScript.py file, I didn't see any problems with that.

Any suggestions?

Edit: Here's my commands.conf file as requested. This is per the Splunk.com entry on commands.conf

[get_asn]
type = perl
filename = get_asn.pl
streaming = true
retainsevents = true
0 Karma

jpass
Contributor

Try removing the underscore in: [get_asn]

I'm not 100% sure but I just started learning to use custom command with a perl script and this seemed to fix my issue.

gkanapathy
Splunk Employee
Splunk Employee

I don't know, but I suspect it's a problem running Perl scripts when most search scripts are Python. I assume you have no trouble running, say "rangemap"? I guess it would interesting to see the commands.conf entry (whether you have set the type to perl, and whether you are running distributed search. It may also just be a bug.

0 Karma

Greg_LeBlanc
Path Finder

Rangemap works great, I will add my commands.conf entry above. And yes - I am using distributed search over n number of indexes.

0 Karma

Medavian
Explorer

Umm, .py files are python scripts aren't they ?

Not sure if SPLUNK supports perl scripts, but I would change the extension to a .pl in case that is screwing with the script interpreters.

0 Karma

jpass
Contributor

Splunk supports PERL Scripts.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...