Getting Data In

Scripted Input: Cannot open file from /myapp/local

vincenteous
Communicator

Hello all,

I have a perl script which is located in /myapp/bin and a configuration file in /myapp/local. I have added a script stanza inside inputs.conf and the script seems to be successfully invoked except for one thing, the script displays an error on splunkd.log that tells my custom configuration file cannot be opened. I have tried using an absolute path to that file and the result is still the same. Can anyone tell me where did I go wrong?

Thanks in advance.

Tags (3)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi vincenteous,

did you place this in /myapp/.. or in $SPLUNK_HOME/etc/apps/myapp/..
Have a look at the docs about scripted inputs where you also get some hints where to put config files.
Another point to mention here: enable debugging in your script and run it like this:

  $SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/etc/apps/myapp/bin/yourscript

and see what happens.

cheers, MuS

View solution in original post

slashnburn
Path Finder

I just struggled with this and I determined the best to accomplish this task is to include the scripts in the $SPLUNK_HOME/bin/scripts folder. Visibility and permissions become a real pain when placing the scripts in a custom app folder.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi vincenteous,

did you place this in /myapp/.. or in $SPLUNK_HOME/etc/apps/myapp/..
Have a look at the docs about scripted inputs where you also get some hints where to put config files.
Another point to mention here: enable debugging in your script and run it like this:

  $SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/etc/apps/myapp/bin/yourscript

and see what happens.

cheers, MuS

vincenteous
Communicator

I placed my files under the $SPLUNK_HOME/etc/apps/myapp/ directory. I suppose something is off in my script. Will try to debug it using that command. Thanks again, MuS.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...