All Apps and Add-ons

S.o.S TA Unix - Error nfs-iostat.py - no splunk.bundle

chrisitanmoleck
Path Finder

Good Morning,

I installed the S.o.S Add-on on Suse Linux Enterprise.
I activated the ps_sos.sh, lsof_sos.sh, nfs-iostat_sos.py in the inputs.conf of the app.

After a restart of the forwarder, I get following error-message in the logfile:

Traceback (most recent call last):
File "/opt/splunkforwarder/etc/apps/TA-sos/bin/nfs-iostat.py, line 27, in
import splunk.bundle
ImportError: No module named splunk.bundle

I tried to setup the python path via (found in Splunk/Answers)

/opt/splunkforwarder/bin/splunk cmd python /opt/splunkforwarder/etc/apps/TA-sos/bin/nfs-iostat.py

After executing this command I get following error-mesage:

couldn't run "/opt/splunkforwarder/bin/python": No such file or directory

What I have to do?

Thanks for your help.

Best regards,
Christian

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

hexx
Splunk Employee
Splunk Employee

@martin_mueller is correct on all accounts. This script has been added to the S.o.S add-on in case you would like to install just that on one of your pooled search-heads instead of the whole app, and still benefit of this scripted input.

martin_mueller
SplunkTrust
SplunkTrust

The TA is also meant for full Splunk instances such as indexers and search heads, reporting values to the SoS app but without any requirement for local dashboards.

As for that specific script, here's its purpose from the app release notes: "* [SUP-573] A new scripted input is now available to monitor the I/O usage of pooled search-heads on the shared NFS device: nfs-iostat_sos.py"
Search Heads always have a full Splunk Python installation.

chrisitanmoleck
Path Finder

Then, I don't understand why these .py file is included in a TA.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You don't have the libraries included in full Splunk installations though. The doc linked says this: "If you have been using calls specific to Splunk's Python libraries, you cannot do so with the universal forwarder, because those libraries exist only in full Splunk Enterprise."

0 Karma

chrisitanmoleck
Path Finder

Python 2.6.9 is already installed.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...