Splunk Search

Custom modules not loading

joonradley
Path Finder

Hi,

I have created some custom modules, but receive warnings that the module cannot be found when opening the view containing the modules.

Originally the modules where created under the following directories:

$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/search/mod1.conf
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/search/mod1.js
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/prototype/mod2.conf
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/prototype/mod2.js

The modules showed up under splunk.xxx.com:8000/modules and modules loaded correctly when the view was loaded.

I then moved the modules to the app directory:

$SPLUNK_HOME/etc/apps/myapp/appserver/modules/mod1.conf
$SPLUNK_HOME/etc/apps/myapp/appserver/modules/mod1.js
$SPLUNK_HOME/etc/apps/myapp/appserver/modules/mod2.conf
$SPLUNK_HOME/etc/apps/myapp/appserver/modules/mod2.js

The modules showed up under splunk.xxx.com:8000/modules with the new paths, but when loading the view containing them I get the error - Splunk encountered the following unknown module: "mod1" . The view may not load properly.

Next I moved the modules back to the share directory, but under a new sub directory:

$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/mymods/mod1.conf
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/mymods/mod1.js
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/mymods/mod2.conf
$SPLUNK_HOME/share/splunk/search_mrsparkle/modules/mymods/mod2.js

Again the modules showed up under splunk.xxx.com:8000/modules with the new paths, but when loading the view containing the modules I get the same error message as above.

When I moved the modules back to the original directories where they where developed all worked fine again.

Can any one tell me what I am doing wrong?

Regards

Joon

Tags (1)

sideview
SplunkTrust
SplunkTrust

fwiw I found the mistake I'd made that was preventing them from loading. In the .conf file I listed the classname as instead of Splunk.Module. . Once i fixed that they worked like a charm.

zscgeek
Path Finder

I was able to get a custom mod working after much hair pulling however it was touch ago go every step of the way.

This is what I have for a file layout:

First Mod

./etc/apps/prophecy-premise/appserver/modules/VAppBar/VAppBar.conf
./etc/apps/prophecy-premise/appserver/modules/VAppBar/VAppBar.css
./etc/apps/prophecy-premise/appserver/modules/VAppBar/VAppBar.html
./etc/apps/prophecy-premise/appserver/modules/VAppBar/VAppBar.js

Second Mod

./etc/apps/prophecy-premise/appserver/modules/VTitleBar/VTitleBar.conf
./etc/apps/prophecy-premise/appserver/modules/VTitleBar/VTitleBar.css
./etc/apps/prophecy-premise/appserver/modules/VTitleBar/VTitleBar.html
./etc/apps/prophecy-premise/appserver/modules/VTitleBar/VTitleBar.js

I put each mod in it's own folder in order to get it to load. I am pretty sure this is critical for it to work.

Please note that the JS script is VERY VERY finicky. If there are any errors whatsoever in your code it will silently fail with the error you are seeing above.

My pain and suffering is documented on the answers page over at How to get rid of warning for custom modules?

sideview
SplunkTrust
SplunkTrust

I know it has been years, but for the record another thing that can seriously cause confusion, is that if you have any other app installed that has a directory by that name inside appserver, and a partial set of files therein, or a modulename.conf file in it with a typo, Splunk is very bad about logging anything about the duplicate module and both versions of the module will just quietly die.

0 Karma

joonradley
Path Finder

Thank you for your responses.

I thought I would just give feedback on your suggestions.

@zscgeek: Your suggestion of placing each module in its won directory using the module name as the directory name did not work for me. I tried different capitulation. Neither did the module named directories work under the share/splunk/mr_sparkle/ modules direrctory.

@zscgeek: The javascript works 100% when the modules are placed under the normal directories.

@nick: In my case the class name is already Splunk.Module.<modulename>.

I will work try again to resolve this next month when we work on the second version of the app.

0 Karma

sideview
SplunkTrust
SplunkTrust

I have not been able to get custom modules working either, and im similarly baffled. sorry i cant help but im also interested. I know people have done it so maybe they can see what you/we are doing wrong.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...