Getting Data In

Scripts : path to executables (perl)

bdunstan
Path Finder

When running an external script, where is the executable defined ?

That is, it always seems to call /usr/bin/perl and I want it to use a different installation.

Is the location of perl defined in a configuration file or is it taking it from the splunk-users environment ?

Tags (2)
0 Karma

bdunstan
Path Finder

I have that in the perl script, but it appears from the splunk logfile, it is calling it with /usr/bin/perl script.pl - therefore splunk is trumping the #!/usr/local/bin/perl that is defined in script.pl.

I have in commands.conf

[script]
filename = script.pl
type = perl

I was wondering if there was a way to define which perl it is using, ie: path, which is then used for perl/python/shell(bash) etc...

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Ah-ha. Commands.conf is a bit different. If you do the following command you will see the following first two lines of the result as shown below:

$ strings splunkd | grep perl
perl
/usr/bin/perl

What you see is that there is a high likelihood that the type from the commands.conf file is special (because if you use type = python, then it will run the python script through Splunk's python interpreter. So it might be that the script is run through a predefined location for perl.

Could you create a symbolic link to /usr/local/bin/perl in /usr/bin:

ls -s /usr/local/bin/perl /usr/bin/

This is not an ideal solution, but it should take care of your problem.

I haven't seen any examples or documentation that specifically references this kind of issue, but most systems today have perl preinstalled in /usr/bin, so that could be the reason that it made sense for the Splunk engineers to do something like this. Like I say, I don't know if this is really the case, but it seems likely.

0 Karma

bdunstan
Path Finder

I dont have permission to do a symlink back to /usr/bin and I also dont want to break anything by overwriting /usr/bin/perl with /usr/local/bin/perl.

The other thing I can think of is to use a shell/perl/python script and call it from there with the required perl, but that seems like a hack - I read somewhere that only perl/python are viable scripts - so maybe shell wouldnt work ?

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

You can create a perl or python wrapper script and set up the /usr/local/bin/perl as the perl binary to be used instead of /usr/bin/perl. If you use Perl, use a fork() with the arguments starting with "/usr/local/bin/perl" and the second argument being the script you want to run. That should do the trick for you as well.

0 Karma

bdunstan
Path Finder

Thanks. I have done something similar and it works fine now - but would be nice if there is the ability to specify an 'exec-path' as a config.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Create an answer with the details of what you did, then accept your answer as the accepted answer, then the question will be marked with an accepted answer and others can find it more compelling to look at. You'll also get karma points for answering the question.

Good work! 🙂

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

The first line of the script file will usually tell you where it is looking for the perl binary. For example:

#! /usr/bin/perl

is going to look for perl in /usr/bin, while

#! /usr/local/bin/perl

would look for it in /usr/local/bin instead. If you want to use it in a different location, just set the location in the first line of the perl script as shown in the examples above. If there is no similar line at the top of your script, just add a first line like the examples. The slash-exclamation (often referred to as sh-bang) is the way that the scripts tell the binary used by script files.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...