Splunk Dev

scripted input does not produce same results as running script manually

bkwoka
Explorer

I have a python script that queries a mongo database and pulls all the results since the last time the script ran. it then stores the date of the last event it pulled to a text file to reference later. When I run this script manually it works exactly as intended. When it runs through Splunk it never creates the text document that contains the last date pulled and for some reason it only returns the last document when it should return multiple events.

my configuration is as follows:

inputs.conf
[script://$SPLUNK_HOME/etc/apps/xdrip_mongo/bin/entries.py]
disabled = false
interval = 30
source = xdrip
sourcetype = mellitus_entry

props.conf
[mellitus_entry]
SHOULD_LINEMERGE = false

and the relevant portion of python:

try:
    f_lastDate = open('lastDate.txt', 'r')
    s_lastDate = f_lastDate.read()
    try:
        int_lastDate = int(s_lastDate)
    except ValueError:
        int_lastDate = 0
except IOError:
    int_lastDate = 0
    s_lastDate = str(int_lastDate)
f_lastDate = open('lastDate.txt', 'w')

for doc_entry in entries.find({'date': {"$gt": int_lastDate}}):
    print "_id = %s, date = %s, dateString = %s, device = %s," \
          "direction = %s, filtered = %s, noise = %s, rssi = %s," \
          "sgv = %s, type = %s, unfiltered = %s" % \
            (doc_entry['_id'],
                doc_entry['date'],
                doc_entry['dateString'],
                doc_entry['device'],
                doc_entry['direction'],
                doc_entry['filtered'],
                doc_entry['noise'],
                doc_entry['rssi'],
                doc_entry['sgv'],
                doc_entry['type'],
                doc_entry['unfiltered'])

    s_lastDate = str(doc_entry['date'])

f_lastDate.write(s_lastDate)
0 Karma
1 Solution

bkwoka
Explorer

I figured it out. The script is running with system32 as the working directory. I assumed it would be running in the /bin of the app. Once I hardcoded the absolute path it worked.

View solution in original post

0 Karma

micahkemp
Champion

Refer to a previous answers post in regards to testing your script with the same environment that will be used when the script is run for your input.

It's likely that your runtime environment looks different when you're running it manually to test and when it's run by Splunk.

0 Karma

bkwoka
Explorer

I figured it out. The script is running with system32 as the working directory. I assumed it would be running in the /bin of the app. Once I hardcoded the absolute path it worked.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...