Getting Data In

Windows props.conf source stanza - Can't use the embedded Python interpreter

guilmxm
SplunkTrust
SplunkTrust

Hi,

I have developed an App "Nmon performance Monitor for Unix and Linux Systems" (http://apps.splunk.com/app/1753/)

I am currently working on a new release which will allow Windows OS to achieve the conversion step required by the App, this is being achieved by a third party Python script.

Currently, for *nix hosts, the props.conf source stanza is:

# Source stanza for nmon2csv.py script
# This source stanza will be called by the archive processor to convert NMON raw data into csv files
# SPlunk can manage. See inputs.conf for the associated monitor
# The standard nmon App and PA-nmon App will use the embedded splunk interpreter

[source::.../*.nmon]

invalid_cause = archive
unarchive_cmd = $SPLUNK_HOME/bin/splunk cmd python $SPLUNK_HOME/etc/apps/nmon/bin/nmon2csv.py
sourcetype = nmon_processing
NO_BINARY_CHECK = true

I have tried with no sucess to transpose this to Windows, like:

[source::...\.*.nmon]

invalid_cause = archive
unarchive_cmd = $SPLUNK_HOME\bin\splunk.exe cmd python $SPLUNK_HOME\Splunk\etc\apps\nmon\bin\nmon2csv.py
sourcetype = nmon_processing
NO_BINARY_CHECK = true

It does not work, giving errors in splunkd.log like:

 ERROR ArchiveContext - archive writer failure: errno=Le canal de communication est sur le point d’être fermé.

I have tried to use the full path of Splunk and i have tried to protect the "Program Files" directory name with no luck (with " () ' )

[source::...\.*.nmon]

invalid_cause = archive
unarchive_cmd = C:\Program Files\Splunk\bin\splunk.exe cmd python C:\Program Files\Splunk\etc\apps\nmon\bin\nmon2csv.py
sourcetype = nmon_processing
NO_BINARY_CHECK = true

I could be tempted to think that the problem comes from the directory name and its white space, but if i install as a dependency a Python 2x package in Windows (so i can later call any python script from Windows) and if i simply use:

[source::...\.*.nmon]

invalid_cause = archive
unarchive_cmd = C:\Program Files\Splunk\etc\apps\nmon\bin\nmon2csv.py
sourcetype = nmon_processing
NO_BINARY_CHECK = true

Everything works perfectly and my lib script will convert my data as exepected.

My goal is to use the embedded Python interpreter not to have to ask users to install to be able to use the App.

As it is, i am currently unable to use the embedded Python interpreter in Windows where i do not have any issue with any other *nix OS.

Does anyone has some idea ?

Thanks !

0 Karma
1 Solution

guilmxm
SplunkTrust
SplunkTrust

Solved by installing (and recommending users to) standalone Python interpreter in Windows

Thus i could never used the embedded Python interpreter only in Windows.

View solution in original post

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Solved by installing (and recommending users to) standalone Python interpreter in Windows

Thus i could never used the embedded Python interpreter only in Windows.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...